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utili2€d  in  the  coarse  entitled  "Warheads  and  Lethality" 
(AE-3705).  This  portion  of  the  text  includes  an  unclassi- 
fied discussion  of  a  target's  susceptibility  to  an  exter- 
nally detonating  HE  warhead  and  a  target's  vulnerability. 
In  particular,  the  section  on  target  susceptibility  leads  to 
the  development  of  the  number  of  fragments  which  strike  a 
target  aircraft  from  an  externally  detonating  warhead.  The 
section  on  target  vulnerability  explains  the  methodology 
used  for  identifying  critical  components  and  conducting  a 
vulnerability  assessient,  and  leads  to  the  effects  of  frag- 
ments and  penetrators  striking  an  aircraft. 
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I.  SUSCEPTIBILITY  TO  EXTERHAIIY  DETONATING  FRAGMENIAIION 

WABHIipS 

A.   IBTECDDCTIOl 

Susceptibility  refers  to  the  inability  of  a  target  to 
avoid  being  damaged  in  the  pursuit  of  its  mission.  For 
aircraft,  susceptibility  to  an  externally  detonating  warhead 
refers  to  an  aircraft's  probability  of  being  hit. 
Susceptibility,  like  vulnerability,  is  good.  The  level  or 
degree  of  susceptibility  of  an  aircraft  in  a e  encounter  with 
a  threat  is  dependent  upon  three  major  factors,  the 
encounter  scenario,  the  threat,  and  the  aircraft.  The 
encounter  scenario  includes  the  missile  and  aircraft  posi- 
tions, velocity  vectors,  respective  attitudes,  a  determina- 
tion of  the  warhead's  fragment  dynamic  spray  angles,  a 
deternination  of  the  missile  miss  distance,  and  the  determi- 
nation of  how  many  fragments  or  penetrators  strike  the 
aircraft.  The  important  features  of  the  threat  are  its 
characteristics,  its  operations,  and  its  lethality.  The 
important  aircraft  features  are  the  aircraft  detectable 
signatures,  countermeasures,  performance  capabilities,  and 
self-protection  armanent. 

B-   ENCCDNTEH  SCEHABIC 

Tie  encounter  scenario  takes  into  account  the  missile's 
flight  path  and  the  target's  flight  path  to  allow  calcula- 
tion of  the  missile  liss  distarce,  fragment  miss  distance, 
the  warhead's  dynamic  fragment  spray  angles  and  velocities, 
and  the  number  of  fragments  which  strike  the  target. 
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1 .   Warhead  Dynaniic  Sgra^  Angles  and  Velocities 

When  a  warhead  detonates  in  the  vicinity  of  an 
aircraft,  the  fragments  or  pecetrators  are  usually  ejected 
uniformly  around  the  missile  axis  and  propagate  outward  in  a 
divergent  spherical- like  spray  pattern  at  a  velocity  that  is 
the  vector  sum  of  the  initial  fragment  ejection  velocity 
from  a  static  warhead  detonation  and  the  missile  velocity. 
The  fragment  at  the  front  of  the  warhead  is  assumed  to 
propagate  outward  at  the  leading  spray  angle,  and  the  frag- 
ment at  the  tail  end  of  the  warhead  is  assumed  to  propagate 
along  trajectory  at  the  trailing  spray  angle.  All  other 
fragment  trajectories  lie  between  these  two  spray  angles  and 
constitute  the  fragment  spray.  As  the  aircraft  moves  in 
space,  the  fragments  propagate  outward  and  eventually  some 
of  the  fragments  may  strike  the  aircraft.  Whether  or  not 
any  of  the  fragments  strike  the  aircraft  and  where  they  hit 
depend  upon  the  relative  positions,  velocities,  and  the 
attitude  of  the  warhead  and  the  aircraft  at  the  time  of 
detonation  (encounter  conditions)  and  the  fragment  static 
velocities  and  static  spray  angles.  A  sample  warhead 
depicting  static  fragment  spray  angles  and  velocities,  and 
dynamic  fragment  spray  angles  and  velocities  is  depicted  in 
Figure  1.1.  Osing  the  law  of  cosines  and  Figure  1.1,  the 
dynamic  fragment  velocity,  V^^  ,  is  given  by: 

\^  =  V^  *    ^s^  -  (2  X  V^  X  V^  X  Cos  3  )  (1.1) 

where   V      is   the    missile    velocity      and    V      is   the    static    fraq- 
m  ■'  s 

ment  velocity.  Since  the  angle  3  is  not  known.  Equation  1-  1 
must  be  rearranged  to  use  the  only  known  angle,  which  is  the 
static  fragment  spray  angle,  a  .  Rearranging  Equation  1.1, 
the    dynamic  fragment    velocity    is   given    by: 

V.2    =V2+v2-£2xV       XV      X    Cos(180-a.)]  (1.2) 

1  m  s  m  s  1 
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Again  referring  to  Figure  1.1,  the  dynamic  fragment  velocity 
may  te  written  in  vector  notation  as: 

^i  =  C^m  *  (^s  X  Ccsa.)  ]i  +  [^s  X  Sina.Jj  (1.3) 

Solvirg  Eguation  1.3  for  the  djnamic  fragment  spray  angle, 
(f).  ,  yields: 

0i   =  Tan-i[  (V3  X  Sinai)  /  l\    *    (\     ^    Cosol)  ]]      (1.4) 

Now  that  the  dynamic  fragment  spray  angles  and  velocities 
are  known,  the  fragment  spray  density  may  be  determined. 

2 .   Fragment  S£r a_j  Density 

Ihe  damage  inflicted  or  an  aircraft  depends  on  the 
number  and  the  location  of  the  fragment  impacts,  and  on  the 
terminal  effects  parameters  such  as  the  fragment  mass  and 
impact  velocity.  For  this  derivation  of  the  fragment  spray 
density,  the  following  assumptions  are  made: 

1.  The  fragments  lie  on  a  spherical  segment  whose  center 
is  at  the  center  of  the  warhead. 

2.  The  fragments  emerge  from  the  warhead  in  such  a  way 
that  they  remain  on  the  surface  of  an  expanding  sphere. 

An  encounter  scenario  with  a  horizontally  moving  aircraft, 
and  based  on  the  assumptions  stated  above,  is  depicted  in 
Figure  1.2. 

For  any  given  fragment  spray  zone,  the  density  of 
fragments  within  that  zone  is  simply  the  number  of  fragments 
contained  in  the  zone  divided  by  the  surface  area  of  the 
sphere  contained  within  the  conical  angles  defining  the 
zone.  The  average  rumber  of  fragments  per  unit  area  of 
fragment  spray,  known  as  the  fragment  spray  density  ,  p  ,  is 
given  by  Eguation  1-5. 
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Figure  1.2   Sample  Encounter  with  a  Horizontally  Moving 
Aircraft  Depicting  the  Fragaent  Spray  Density 
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p      =    N    /    A  (1.5) 

vhere  N  is  the  total  number  of  fragments  in  the  warhead  and 
A  is  the  area  the  fragments  are  spread  over.  Referring  to 
Figure    1.2,    the   area.   A,    is    given   by: 

A    =    2xiTx)       (sxSin<|))xsd(t>  (1.6) 

Solving   Equation    1.6    leads   to   tie   solution: 

A    =    2x     TTxs^x     (Cos  \     -   Czs  <^2)  (1-7) 

Substituting  Equation  1.7  into  Equation  1.5  yields  the  frag- 
ment spray  density  at  some  distance  s  from  the  detonation 
point : 

p=N/[2x      7Txs2x    (Cos   4)1   -    Cos   (|^   )  ]  (1.8) 

where  the  leading  and  trailing  dynamic  fragment  spray  angles 
are  defined,  with  respect  to  the  warhead  axis,  by  Equation 
1.4. 

3.   Missile  Miss  Eistance 

Eor  the  calculation  of  nissile  miss  distance,  it  is 
assumed  that  the  encounter  is  tvo  dimensional,  and  that  the 
target's  velocity  and  the  missile's  velocity  remain 
constant.  Two  approaches  to  calculate  the  miss  distance 
will  he  presented.  The  first  approach  is  the  global 
approach. 

a.   Global  Approach 

Figure  1.3  depicts  a  typical  encounter  situation.  Figure 
1.U  depicts  the  same  encounter  situation  using  vector  nota- 
tion. Referring  to  Figure  1.4,  and  using  vector  addition, 
the  missile  miss  distance,  "s,  is  given  by  Equation  1.9. 
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T+t=M+m+s  (1.9) 

Eearranging    Equation    1.9    and   solving    for  "i    leads    to: 

s    =    (T   -    M)    +     (t   -    m)  (1-10) 

The  initial  conditions  (at  time  t  =  0)  are  given  by 
Equations  1.11  and  1.12.  The  conditions  at  some  later  time 
(t  =  T  )  are  given  by  Equations  1.13  and  1.14. 

T  =  (T^)i  +  (T^):'  (1.  11) 

M  =  (M  )  1  +  (M  )'j^  (1.  12) 

t  =  (V^  X  T  ) T  (1.  13) 


=    (V      X    T  X    Cose   )i+(V      XTXSine)j  (1.14) 

"  m 


m 


Substituting   these   conditions   back    into    Equation    1.10    gives: 
i    =    [  (T^    -   H^)i   +     (T^   -    M^)T]  +    [  ((V^    X     T)  (1.15) 


-    (V      X     T     X   Cos  9  )  )'i    -    (V      X     T     X    Sin  0  )  j  ] 

™  m 


m 


Eearranging   Equation      1.15   and   combining      similar    components 
gives: 

i    =   [  (T      -   M    )    +    [         X     (V      -     (V      X   Cos  e  ))  j]i  (1.16) 

+    [  (T      -   M    )    -     (7      X     T     X    Sin  e  )  ]j 

y         y  m 

The    missile   miss      distance    is    given    by      taking    the    magnitude 
of    Equation    1.16    which   is: 


I  s  j     =    [  (T^    -    M^)     +    [  T     X     (V       -    (7       X    Cos  e  )  )  ]  ]2 

+    [  (Ty    -   M^)    -     (V^    X     T     X    Sine  )  ]2 
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Of  interest  is  the  minimuin  miss  distance.  Taking  the  deriv- 
ative of  Equation  1.17  with  respect  to  t,  and  setting  it 
equal   to  zero   yields: 


C  {{T      -    Ml     X     {V       -    {V       X    Cos  9)})     -     {(T       -    M    )  (1.  18) 

X    (V      X   Sin  0  )  }  ]   +   [    1 

m 

+     (Vn,    X   Sin  9)  2]]   =    0 


X    (V      X   Sin  9  )  }  ]   +   [    T    X    [  {V      -    (V      x    Cos  9  )  }  2 

m  t  m 


Solving    Equation      1.18   for  t    yields     t    for    the      minimum   miss 
distance   which    is: 


=    [  ((T^    -    fl^)    X    V      X    Sin   9)     +     ((T      -    M    )  (1.19) 

X    V      X    Cos    9)     -     ({T      -    M    )     X    7    )  ]    / 

m  X  X  t 

[  (Vt    -    (V^    X   COS  9  ) )  2    +     (V^  X    Sin   9  )  2  ] 

The  minimum  missile  miss  distacce  is  then  given  by  substi- 
tuting the  value  of  t  ,  obtained  from  Equation  1.19,  into 
Equation    1 . 17. 

b.      Local   Approach 

The  local  approach  is  an  alternative  approach  to  the  one 
described  above.  In  the  local  approach,  the  target  remains 
stationary  and  the  target's  velocity  vector  is  superimposed 
on  the  missile's  velocity  vector.  This  geometry  is  depicted 
in  Figure  1.5.  From  Figure  1.5,  the  velocity  of  the  missile 
with    the   target's   velocity   superimposed,    V^^^^     ,    becomes: 

V  .     =     (V      X   Cos   9)1   +    (V      X    Sin   6)  j    -     (V.)T  (1.20) 

m  m 

Rearranging    Equation    1.20    into    a   more   suitable    form    gives: 
V^     =    [  (V      X    Cos   6)    -   V    ]i    +    [V      X    Sin    6  Jj'  (1.21) 
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The  derivation  of  tie  minimui  nissile  miss  distance  in  the 
local  system  follows  the  same  procedure  as  for  the  glotal 
system,  and  since  it  leads  to  the  same  result  as  given  by 
Equation  1.17,  the  derivation  will  not  be  repeated. 

From  the  geometry  of  Figure  1. 5,  it  is  possible 
to  determine  if  the  missile  will  be  a  "late  bird"  or  an 
"early  bird".  An  "early  bird"  is  where  the  closest  point  of 
approach  (CPA)  of  the  missile  is  in  front  of  the  target  in 
the  local  system.  A  "late  bird"  is  where  the  CPA  of  the 
missile  is  behind  the  target.  This  relationship  may  be 
determined  graphically  with  the  use  of  the  following 
formula : 

'e  =  Tan-i  [  (Vjj,  X  Sine  )  /  [  (V^^  x  Cose  )  -  V^  ]  ]     (1.22) 

Now  that  the  missile  miss  distance  has  been 
calculated,  and  knowing  the  fragment  spray  density,  a  deter- 
mination must  be  made  as  to  whether  or  not  the  fragments  hit 
the  target,  and  if  so,  how  many  fragments  strike  the  target. 
To  accomplish  this,  the  fragment  miss  distance  must  be 
determined. 

^  •   Z^§Sl^Iil  lLi§^  Distance 

As  was  the  case  for  missile  miss  distance,  the  frag- 
ment miss  distance  may  be  derived  in  either  a  global  coordi- 
nate system  or  in  a  local  coordinate  system.  Figure  1.6 
depicts  the  fragment  iriss  distaice  for  the  global  coordinate 
system,  and  Figure  1.7  depicts  the  miss  distance  for  the 
global  system  using  vector  notation.  Figure  1.8  depicts  the 
fragment  miss  distance  in  the  local  coordinate  system.  The 
derivation  of  the  fragment  miss  distance  in  a  global  coordi- 
nate system  follows.  Referrirg  to  Figure  1.7,  and  using 
vector  addition,  the  fragment  miss  distance,  c,  is  given  by 
Equation  1.23. 
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c    =     (T    -    F)     +     (t    -    f)  (1.23) 

The  initial  conditiocs  are  given  by  Equations  1.2U  and  1.25. 
The  conditions  at  scire  later  time  (t  =  '^  )  are  given  by 
Equations    1.26    and    1.27. 

1  =    (T^)T    +     (T    )  j'  (1.24) 

y 

F    =     (Fx)i    +    (Fy)  j"  (1.25) 

t    =    (Vt   X     T  )'i  (1.26) 

f    =    (V^   X     T     X   Cosy)'i    +    (V^    J     T     X    SinY)3^  (1.27) 

Substituting  these  conditions  tack  into  Equation  1.23,  and 
solving  for  c,  leads  to: 

c  =  [  (Tx  -  F^)  -  (  T  X  {(V.  X  Cos  y  )  -  V^))  ]i      (1.28) 
[  (Ty  -  Fy)  -  (  T  X  Vi  X  Sin  y  )  ]J 

The  magnitude  of  Equation  1.28  is: 

|c|  =  [  (T^  -  F^)  -  IT  X  ((V.  X  Cos  y)  -  V^)}  ]2    (1.29) 
+  [(T^  -Fy)  -  (  T  X  V.  X  Sin  y)  ]2 

To  find  the  minimum  fragment  miss  distance,  t  for  the 
minimum  miss  distance  is  needed.  Taking  the  derivative  cf 
Equation  1.29  with  respect  to  t  ,  and  setting  it  equal  to 
zero  yields: 

T  =  [  {  (T^  -  F^)  X  1(V.   X  Cos  y)  -  V^}}  +  (1.30) 

{(Ty  -  Fy)  X  V.  X  Sin  y} ]  /  [  ((V   X  Cos  y)  -  V  )  2 

+  (V.  X  Sin  y)  2] 

1 
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To  find  the  rainimum  fragment  niss  distance,  simply  solve 
Equation  1.30  for  t  ,  and  substitute  that  value  of  t  into 
Equation  1.29.  This  derivation  assumed  that  the  fragment 
velocity  was  constant.  If  the  fragment  velocity  is  not 
constant,  or  reasonatly  so,  then  f  is  given  by: 


f  =  /  [  (7.  X  Cos  Y  )i  +  (V.  X  Sin  y  )  j  ]  ^ 

0      ^  ^ 

Solving  Equation  1.3  1  gives: 

r 

f    =    [  (Cos  Y  )  i    +    {SinY)j]    x     J    Vi  (  t  )     di 


(1.31) 


(1.32) 


Now  that  the  fragment  miss  distance  has  been  calculated,  the 
number  of  fragments  which  strike  the  target  will  be 
determined. 

5  •      Fragment   I m^act s   on    th e   Target 


The    number    of      hits. 


on    the      aircraft    presented 


area    at    the   aspect    under   consideration,    A    ,    is   given    by: 


n    =    p     X 


^ 


(1.33) 


where  p  is  the  fragment  spray  density  defined  by  Equation 
1.8.  Figure  1.9  depicts  the  fragment  spray  density  striking 
an  aircraft  in  the  local  coordinate  system  described 
earlier,  where  f ^  and  f2  represent  the  leading  edge  and 
trailing  edge  fragment  vectors,  respectively.  The  angle  "y 
is  defined  as: 


/>rf 


y  =  Tan-»  [(V.  X  Siny  )  /  {  (1.     x  Cosy  )  -  V  )]   (1-34) 

1        i        1        i      t 

Figure  1.10  depicts  the  same  geometry  in  the  global  coordi- 
nate system  described  earlier.  Recall  from  Equation  1.8 
that   the  distance  the  fragments  travel  before  striking   the 
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aircraft,  H ,    is  needed  and  not  F^   .    The  time  from  detona- 
tion to  fragment  impact  in  the  global  system  is: 

t  =  E  /  V.  (1.35) 

The  time  from  detonation   to  fragment   impact  in   the  local 
system  is: 

t  =  Edet  /  Vft  (1-36) 

where   V  ^^  is  defined    as  follovs: 

v^^  2   =  [  (V.    X   Cosy  )    -  V    ]2    +  [V.     X  Siny    ]2  (1.37) 

Equating    Equation    1.35    to   Equation      1.36,       and   solving    for   R 
yields: 

R2    =    R        2   /   [  1   -     (2   X    (V    /V    )    X   Cosy  )  (1.38) 

+     (V^/V.)2] 

where  7  is  the  target  velocity  and  V.  is  the  dynamic  frag- 
ment  velocity  as  defined  by  Equation  1.2.  The  extent  of  the 
fragment  spray  which  strikes  the  aircraft,  and  the  number 
and  location  of  fragment  hits,  are  dependent  upon  the 
encounter  conditions.  Figure  1.11  depicts  the  effects  of 
varying  the  detonaticr  distance  to  the  target.  In  zone  1, 
the  full  fragment  spray  hits  the  target.  In  zone  2,  all  of 
the  target  is  hit  by  part  of  the  fragment  spray.  In  zones  3 
and  U,  part  of  the  fragment  Sfray  hits  part  of  the  target. 
In  zone  1,  with  the  target  hit  by  the  full  fragment  sfray, 
the  presented  area  of  the  aircraft  may  be  determined  as 
follows.  Figure  1.12  depicts  a  frontal  view  of  the  fragment 
spray  striking  an  aircraft.  From  Figure  1.12,  the  angle  K 
is  defined  by  Eguaticr  1.39. 
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Figure  1.12   Frontal  View  of  Fragments 
Impacting  an  Aircraft 


C  =  Tan-i  [W  /  (2  X  R  X  Sin  (f)  )] 


(1.39) 


The   circumferential    length   of    tie   spray    zone    is    defined   as: 


b   =    2x     ^xRxSin 


(1.40) 


where  (^  is  the  dynamic  fragment  spray  angle  of  the  center 
fragment.  Substituting  Equation  1.39  into  Equation  1.40 
yields: 

b    =    2    X   R   x    Sin  ^     x   Tan-i    [W    /    (2    x    R    x    Sin  ^  )  ]  (1.41) 
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The  fragnent  spray  zcce  covers  a  spherical  area  of: 

Area  =  b  x  R  x  {  4>2  -  *i  )  (1.42) 

Substituting    Equation    1.42    into   Equation    1.33    yields: 

n=    (Nxb)    /[2x     TT     xRx    (Cos  <t>i     -   Cos  (f>2  )  ]  (1.^3) 

which  determines  the  number  of  fragments  which  strike  the 
aircraft  in  zone  1.  The  assunption  has  been  made  in  this 
estimation  that  the  fragment  spray  covers  the  entire 
presented  area  of  the  aircraft.  If  this  is  not  the  case,  or 
if  only  a  portion  of  the  spraj  meridian  hits  a  portion  of 
the  aircraft  (zones  2,  3,  and  4  in  Figure  1.11),  A  ,  in 
Equation  1.33  must  be  reduced  to  the  actual  area  that  is 
struck  by  fragments.  The  extent  of  the  fragment  spray  which 
does  strike  the  aircraft,  the  number  of  fragment  hits,  the 
fragment  approach  directions,  and  where  the  hits  occur  are 
dependent  upon  the  encounter  ccnditions.  For  example,  a 
detonation  directly  below  the  center  of  the  aircraft  in  a 
head-on  encounter  will  have  a  different  result  than  from  a 
detonation  in  the  sane  place  fcr  a  tail-chasing  missile  due 
to  the  difference  in  the  relative  closing  velocity. 
Furthermore,  changing  the  elevation  angle  of  the  missile  at 
the  time  of  detonation  will  change  the  results.  With  the 
number  of  fragments  which  strike  the  aircraft  deternined, 
the  effects  of  fragments  and  penetrators  striking  an 
aircraft   will   be   examined   in   the   next   chapter. 
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II.    TARGET    VDINEEABILITY 

A.  lUTBODOCTION 

Target  vulnerability  refers  to  the  inability  of  a  target 
to  withstand  one  or  nore  hits  by  damage  mechanisms  (frag- 
ments, penetrators,  incendiary  particles,  and  blast)  or  a 
target's  liability  to  serious  damage  or  destruction  when  hit 
ty  enemy  fire.  Aircraft  that  are  more  vulnerable  are 
softer,  that  is,  they  are  more  likely  to  be  lost  when  hit. 
Therefore,  aircraft  vulnerability  is  essentially  a  measure 
of  the  toughness  of  an  aircraft  when  all  surviveability 
measures  have  failed  and  the  threat  interacts  with  the 
aircraft.  From  an  air  defense  standpoint  target  vulner- 
ability is  good. 

Each  individual  component  cf  an  aircraft  has  a  certain 
level  or  amount  of  vulnerabilit j.  Each  component's  vulner- 
ability then  contributes,  in  seme  measure,  to  the  overall 
vulnerability  of  the  aircraft.  The  critical  components  of 
an  aircraft  are  those  components  that  are  essential  to  the 
functioning  of  a  system,  and  if  the  component  performance  is 
sufficiently  degraded  or  if  the  component  is  rendered  inop- 
erative by  combat  damage,  a  target  kill  in  some  kill 
category  will  result.  The  systematic  description,  delin- 
eation, and  quantification  of  the  vulnerability  of  the  indi- 
vidual components  and  vulnerability  of  the  total  aircraft  is 
known  as  a  vulnerability  assessnent. 

B.  IDENTIEICATION  OE  CRITICAL  COMPONENTS 

The  first  step  in  a  vulnerability  assessment  is  the 
identification  of  those  comporents  whose  damage  or  loss 
could  lead  to  an  aircraft  kill,   and  they  are  referred  to  as 
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critical  components.  This  idertif ication  process  is  called 
critical  component  analysis.  J\  component  may  be  a  critical 
component  because  it  provides  an  essential  function  such  as 
thrust,  lift,  or  control.  A  component  may  also  be  a  crit- 
ical ccmponent  because  its  mode  of  failure  leads  to  the 
failure  of  a  critical  component  that  does  provide  an  essen- 
tial function.  For  example,  a  fuel  tank  in  a  wing  can  be 
perforated  by  a  fragnent,  causirg  a  slow  fuel  leak  and  even- 
tual fuel  depletion,  with  no  substantial  effect  on  the 
continued  operation  cf  the  aircraft.  In  this  situation,  the 
wing  fuel  tank  is  not  a  critical  component.  On  the  ether 
hand,  the  fragment  impact  and  penetration  of  the  wing  tank 
could  cause  ignition  cf  the  fuel  vapor  in  the  ullage,  with  a 
subsequent  fire  or  explosion  and  loss  of  the  aircraft.  In 
this  case,  the  wing  tank  is  definitely  a  critical  component. 
A  general  procedure  has  been  developed  for  determining 
the  critical  components,  their  possible  damage  or  failure 
modes,  and  the  effects  of  the  component  damage  or  failure 
upon  the  continued  operation  cf  the  aircraft.  This  proce- 
dure consists  of:  (1)  a  selection  of  the  aircraft  kill 
levels  or  categories  to  be  considered,  (2)  an  assembly  of 
the  technical  and  functional  description  of  the  aircraft, 
and  (3)  the  determination  of  the  critical  components  of  the 
aircraft  and  their  damage-caused  failure  modes  for  the 
selected  kill  levels. 

1  .   Aircraft  Kil 1  Levels 

To  assess  the  vulnerability  of  both  fixed  wing  and 
rotary  aircraft  in-flight,  four  kill  categories  have  been 
defined.  These  kill  categories  are  the  Attrition  Kill,  the 
Mission  (Mission  Abort)  Kill,  the  Forced  Landing  Kill,  and 
the  Mission  Available  Kill. 
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a.   AttritioE  Kill 

Attrition  kill  covers  those  aircraft  with  ccmtat 
damage  so  extensive  that  it  is  neither  reasonable  nor 
economical  to  repair.  The  attrition  category  is  divided 
into  the  six  levels  cf  kill  listed  below. 

(1)  KK  Kill.  This  level  of  kill  is  associated 
with  danage  that  will  cause  the  aircraft  to  disintegrate 
immediately  upon  being  hit.  This  kill  level  is  also 
referred  to  as  a  Catastrophic  Kill. 

(2)  K  Kill.  This  level  of  kill  is  associated 
with  damage  that  will  cause  an  aircraft  to  fall  out  of 
manned  control  within  30  seconds  after  being  hit. 

(^)  A  Kill'  This  level  of  kill  is  associated 
with  damage  that  will  cause  an  aircraft  to  fall  out  of 
manned  control  within  five  minutes  after  being  hit. 

(^)  1  Kill-  This  level  of  kill  is  associated 
with  damage  that  will  cause  an  aircraft  to  fall  out  of 
manned  control  within  30  minutes  after  being  hit. 

(5)  C  Kill.  This  level  of  kill  is  associated 
with  damage  that  will  cause  an  aircraft  to  fall  out  of 
manned  control  before  completeing  its  mission. 

(6)  E  Kill.  This  level  of  kill  is  associated 
with  damage  that  will  cause  an  aircraft  to  sustain  addi- 
tional levels  of  damage  upon  landing  and  makes  it  uneconom- 
ical to  repair  as  specified  ty  the  applicable  Technical 
Orders,  Technical  Bulletins,  anc  regulations. 

t.   Mission  (I«ission  Abort)  Kill 

This  category  covers  any  aircraft  with  combat 
damage  that  prevents  the  aircraft  from  completing  its 
mission.  This  is  mission  dependent  and  is  divided  into  two 
levels;  mission  abort  and  mission  kill.  Mission  abort 
covers  aircraft  which  are  not  lost  to   inventory  but  cannot 
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complete  their  missicc.  Missicn  kill  covers  aircraft  which 
fall  cut  of  manned  ccntrol  before  completing  their  mission. 

c.  Forced  Landing  Kill 

This  category  covers  those  aircraft  with  ccmtat 
damage  that  forces  the  crew  to  execute  a  controlled  landing 
(powered  or  unpowered) .  This  category  includes  aircraft 
with  damage  which  will  require  repairs  for  flight  to  anctier 
area  and  aircraft  with  damage  which  cannot  be  repaired  on 
site  tut  which  can  be  recovered  by  a  special  team.  This 
category  has  been  restricted  mainly  to  rotary  wing  aircraft 
which  can  land  nearly  anywhere  either  powered  or  by  autoro- 
tation.  It  is  more  difficult  for  a  damaged  fixed  wing 
aircraft  to  successfully  execute  a  forced  landing  (and/or 
subsecuent  takeoff)  since  some  prepared  landing  site  is 
generally  required. 

d.  Mission  Available  Kill 

This  category  covers  those  aircraft  that  have 
landed  with  combat  damage  and  will  require  repair  before 
returning      to   mission     ready   status.  There  are      different 

levels  (intervals)  for  missicn  availability.  The  interval 
of  time  required  to  accomplish  repairs  is  expressed  in 
elapsed    time,    total    man-hours,    cr   combinations   thereof. 

2-      Aircraft   Description 

At  the  beginning  of  any  vulnerability  study,  as  much 
as  possible  of  the  aircraft's  technical  and  functional 
description  must  be  gathered  on  each  of  the  major  systems  of 
the  aircraft.  The  aircraft's  technical  descriptior  consists 
of  engineering  data  which  docunents  the  physical  and  func- 
tional relationships  of  the  aircraft's  subsystems.  The 
types  of  physical  descriptions  utilized  are  general  aircraft 
arrangement      drawings        such      as      three      view        and      inboard 
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profiles,  installaticc  drawings,  and  schematic  diagrams  for 
the  primary  subsystens  to  include:  airframe  structure, 
propulsion  system,  fuel  system,  flight  control  system, 
pneumo-hydraulic  system,  aircrew,  avionics  system,  and 
weapon  and  delivery  systems.  The  suitability  and  quantity 
of  data  available  to  produce  the  necessary  aircraft 
descriptions  are  functions  of  the  status  of  the  system 
withiE  the  acguisiticn  or  deployment  phase.  Aircraft  tech- 
nical descriptions  should  utilize  all  of  the  data  base  to 
include:  engineering  scaled  drawings,  subsystem  functional 
descriptions,  technical  orders  and  manuals,  and  access  to 
design  personnel. 

3  •   Critical  Compcnent  Analysis 

A  critical  ccaponent  is  any  component  that  is  essen- 
tial to  the  functioning  of  a  sjstem,  and  if  the  component 
performance  is  sufficiently  degraded  or  if  the  component  is 
rendered  inoperative  hy  combat  damage,  a  target  kill  in  some 
kill  category  will  result.  Fcr  example,  the  engine  in  a 
single  engine  aircraft  is  a  critical  component  for  an  A  kill 
because  its  loss  would  lead  to  an  aircraft  loss  within  five 
minutes. 

^hen  two  or  more  aircraft  components  are  redundant, 
such  as  two  engines,  the  loss  of  any  one  of  the  redundant 
components  will  not  result  in  the  loss  of  an  essential  func- 
tion and  hence,  that  component  is  not  a  critical  component 
according  to  the  definition  given  above.  This  assumes  that 
the  damage  process  and  loss  of  one  redundant  component  will 
not  lead  to  the  loss  cf  any  other  redundant  components.  Por 
example,  if  one  engine  of  a  tvin  engine  aircraft  starts  to 
burn,  the  assumption  is  made  that  the  fire  will  not  spread 
to  the  other  engine  and  destroy  it.  If  this  were  to  happen, 
there  is  no  actual  redundancy  ard  both  engines  are  nonredun- 
dant  critical  components.     Since  more  than  one   hit  can  be 
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expected  in  a  typical  threat  encounter,  it  is  possible  that 
all  of  the  redundant  components  could  be  killed,  leading  to 
an  aircraft  kill.  Therefore,  the  fact  that  a  component  is 
reduncant  does  not  eliminate  it  as  a  critical  component. 
This  requires  that  a  distincticn  between  the  two  kinds  of 
critical  components  be  made.  In  the  past,  nonredundant  and 
redundant  critical  components  have  been  referred  tc  as 
singly  vulnerable  components  and  multiply  vulnerable  compo- 
nents, respectively.  This  terminology  is  confusing  and  will 
not  be  used  here.  A  given  ccmponent  may  be  nonredundant 
with  respect  to  a  given  kill  category  and  redundant  with 
respect  tc  another  kill  category.  For  example,  consider  a 
twin  engine  helicopter.  If  the  loss  of  either  engine  causes 
a  mission  abort,  the  engines  are  nonredundant  for  the 
mission  abort  category.  If  the  loss  of  both  engines  is 
required  to  cause  a  crash  or  forced  landing,  the  engines  are 
redundant  for  these  two  kill  categories. 

The  first  step  in  a  critical  component  analysis  is 
to  identify  the  flight  and  mission  essential  functions  that 
the  aircraft  must  perform  ir  order  to  accomplish  its 
mission.  The  second  step  is  the  identification  of  the  major 
systems  and  subsystens  that  perform  these  essential  func- 
tions. The  third  step  is  tc  conduct  a  Failure  Mode  and 
Effects  Analysis  (FMEA)  to  identify  the  relationships 
between  each  possible  type  cf  individual  component  or 
subsystem  failure  mode  and  the  performance  of  the  essential 
functions.  The  Fault  Tree  Analysis  (FTA)  is  sometimes  used 
to  provide  additional  insight  into  the  identification  of 
critical  components.  The  fourth  step  is  to  conduct  a  Damage 
Modes  and  Effects  Analysis  (DMEA) .  The  DMEA  relates  compo- 
nent or  subsystem  failure  modes  to  combat-caused  damage. 
The  combination  of  the  third  and  fourth  steps  is  referred  to 
as  the  Failure  Mode,  Effects,  and  Criticality  Analysis 
(FMECA) .    The  last  step  in  a  critical  component  analysis  is 
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a  visual  presentaticE  of  the  list  of  critical  components 
and/or  a  logical  expression  to  identify  the  redundant  and 
nonredundant  critical  componerts  for  the  selected  kill 
level.  The  visual  presentation  is  referred  to  as  a  kill 
tree  and  the  logical  expression  is  referred  to  as  a  kill 
expression. 

a.   Flight  and  Mission  Essential  Functions 

Flight  essential  furctions  are  those  system  and 
subsystem  functions  required  to  enable  an  aircraft  to 
sustain  controlled  flight.  Mission  essential  functions  are 
those  system  and  subsystem  functions  required  to  enable  an 
aircraft  to  perform  its  designated  mission.  The  analysis 
should  consider  each  phase  of  the  mission.  A  typical 
mission  for  an  attack  aircraft  would  include  such  phases  as 
takeoff^  climb  to  cruise  altitude,  cruise  to  attack  area, 
descent  to  attack  altitude,  target  location,  ordnance 
delivery,  egress  from  the  target  area,  climb  to  cruise  alti- 
tude, return  cruise,  descent,  and  landing.  The  flight  and 
mission  essential  furctions  should  be  identified  and  the 
priority  for  possible  protection  established  for  each  of 
these  phases.  For  example,  the  operation  of  the  electronic 
weapons  computer  during  takeoff  is  not  a  flight  essential 
function,  but  it  is  a  missicr.  essential  function  during 
ordnance  delivery.  A  particular  level  of  operation  should 
be  identified  for  the  flight  essential  functions  such  as 
lift,  thrust,  and  control.  For  example,  loss  of  one  engine 
of  a  twin  engine  helicopter  may  not  cause  a  total  loss  of 
lift  and  thrust,  but  it  will  lead  to  a  reduction  of  perform- 
ance capabilities.  This  loss  of  performance  may  not  be 
acceptable  in  a  hostile  environment  because  the  helicopter 
would  become  an  easy  target.  Therefore,  the  continued  oper- 
ation of  both  engines  may  be  required  to  prevent  an  attri- 
tion  kill.    Special   functions   must   also  be   identified. 
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These  include  special  functions  such  as  those  required  for 
the  vertical  flight  cf  a  VTOL  aircraft  or  those  required  for 
arrested  landing  aboard  an  aircraft  carrier.  A  chart  iden- 
tifyirg  some  flight  and  mission  essential  functions  and  seme 
of  the  iiission  phases  for  an  attack  helicopter  is  given  in 
ligure    2.1. 

t.      System-Essential   Furctions   Relationships 

The  ability  of  an  aircraft  to  fly  and  to  conduct 
its  mission  depends  upon  the  continued  operation  of  those 
systems  and  subsystems  that  perform  the  essential  functions. 
If  the  aircraft  is  damaged  ii  combat,  the  operation  of 
certain  subsystem  components  iray  be  impaired  or  the  compo- 
nent may  cease  to  operate,  and  some  essential  functions  may 
be  lost.  The  severity  and  rapidity  with  which  the  less  of 
essential  functions  occur  is  directly  related  to  the  kill 
levels. 

A  general  examinaticn  of  each  aircraft's  systems 
and  subsystems  must  be  conducted  to  determine  its  specific 
contribution  to  the  essential  functions  identified  in  the 
previous  step.  Figure  2.2  presents  a  sample  tabulation  of 
those  systems  and  subsystems  that  contribute  to  the  essen- 
tial functions  shown  in  Figure  2.1.  A  more  detailed  example 
of  the  relationship  between  the  functions  performed  by  one 
specific  subsystem  and  the  essential  functions  is  shown  in 
Figure    2.3. 

c.      Failure    Mode   and    Effects    Analysis    (FMEA) 

The  Failure  Mode  and  Effects  Analysis  is  a 
procedure  that:  (1)  identifies  and  documents  all  possible 
failure  modes  of  a  ccmponent  or  subsystem,  and  (2)  deter- 
mines the  effects  of  each  failure  mode  upon  the  capability 
of  the  system  and/or  subsysten  to  perform  its  essential 
functions.  The  FMEA  process  and  requirements  are  defined  in 
MIL-S1D-785    and    MIL-SlD-162 9A. 
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The  types  of  compccent  failure  modes  generally 
considered  in  the  FMEfl  include  premature  operation,  failure 
to  operate,  failure  during  operation,  failure  to  cease  oper- 
ation,   and   degraded  or   out-cf-tolerance   operation.     A 
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deter nination  of  the  major  structural  or  aerodynamic  damage 
tolerances  is  also  performed  during  the  FUEA.  In  addition, 
the  effects  of  loss  cr  major  damage  to  aerodynamic  surfaces 
on  stability  and  control  of  the  aircraft  are  required.  Data 
generated  should  define  the  threshold  for  aerodynamic, 
structural,  and  control  limits  that  can  be  tolerated  for 
various  flight  conditions.  A  sample  summary  format  for  a 
IMEA  for  two  flight  control  roc  failure  modes  is  given  in 
Figure  2-U.  Note  in  Figure  2.4  that  the  control  rod  is  a 
critical  component  for  an  attrition  kill  when  it  jams,  tut 
not  when  is  is  severed. 

The  FMEA  is  applicable  to  both  single  ccmpcnent 
failures  and  multiple  component  failures.  It  is  extremely 
important  to  consider  multiple  component  failures,  when  the 
failure  is  due  to  combat  damage,  because  of  the  likelihood 
that  lore  than  one  ccmponent  is  damaged  when  the  aircraft  is 
hit. 

The  effects  of  a  ccmponent  failure  should  also 
include  the  consideration  of  anj  transients  that  might  occur 
when  the  failure  occurs.  For  example,  consider  a  single 
engine,  fly-by-wire,  statically  unsTable  aircraft  with  no 
mechanical  flight  controls  as  tack-up.  Suppose  the  engine- 
driven  generator  that  supplies  the  electrical  power  to  the 
flight  control  computer  was  to  immediately  cease  operation 
and  that  the  computer  relies  on  an  emergency  ram-air  turbine 
(RAT)  for  tack  up  electrical  power.  The  RAT  is  designed  to 
he  deployed  into  the  airstrean  when  the  electrical  power 
failure  is  sensed.  However,  this  deployment  takes  time, 
during  which  the  computer  could  be  without  sufficient  power. 
This  lack  of  power  could  cause  problems  with  the  fly-by-wire 
contrcl  system  such  as  the  loss  of  the  SAS  or  the  issuance 
of  hardover  commands  to  the  ccntrol  surfaces  which  could 
cause  the  aircraft  to  become  u  icontrollable,  leading  to  an 
aircraft  loss.  Thus,  the  assumption  of  redundancy  in  the 
electrical  power  system  is  errcreous. 
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d.   Damage  Mode  and  Effects  Analysis  (DMEA) 

In  the  FMIA  the  cause  of  the  component  failure 
is  not  stipulated.  Ihe  failure  may  or  may  not  be  related  to 
combat  damage.  TJhen  specific  component  failures  due  to 
combat  damage,  such  as  mechanical  damage  to  components 
caused  ty  projectile  or  fragnent  penetration  or  damage 
caused  by  a  fire  or  explosion,  are  identified  and  examined, 
the  analysis  is  referred  to  as  a  DMEA.  In  the  DMEA,  the 
potential  component  or  subsystem  failures  identified  in  the 
IMEA,  as  well  as  other  possible  damage-caused  failures,  are 
associated  with  the  damage  mechanisms  and  the  damage 
processes.  These  failures  are  then  evaluated  to  determine 
their  relationship  tc  the  selected  kill  level.  The  quanti- 
fication of  the  component  kill  criteria  is  also  part  of  the 
DMEA,  but  this  procedure  is  described  in  the  vulnerability 
assessment  presentation.  The  jossibility  of  any  secondary 
hazard  that  may  be  caused  by  the  primary  damage  processes  is 
also  identified  in  the  DMEA.  Examples  of  secondary  hazards 
are:  ingestion  of  fuel  by  an  engine,  and  seepage  of  toxic 
fumes  frcm  a  fire  into  the  cockjit.  The  DMEA  is  referred  to 
as  the  criticality  analysis  of  the  FMECA. 

The  output  of  the  E KEA  can  take  many  forms.  The 
DMEA  matrix  is  similar  to  the  IMEA  summary  format  shown  in 
Figure  2.4  in  which  the  components  and  their  damage-caused 
failure  modes  are  related  to  the  kill  level  or  category. 
Component  redundancy  relationships  and  the  appropriate 
component  kill  criteria  should  also  be  indicated  in  the 
matrix.  A  sample  EMEA  matrix  is  given  in  Figure  2.5.  A 
disablement  diagram  can  add  to  the  understanding  of  the  DMEA 
matrix  by  graphically  showing  the  locations  of  the  compo- 
nents and  stating  the  effects  cf  component  kills.  A  sample 
disablement  diagram  is  presented  in  Figure  2.6. 
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There  are  many  different  kinds  of  damage-caused 
failures  or  kill  modes  that  can  occur  within  each  of  the 
systems  cf  an  aircraft.  Failure  modes  for  an  aircraft  are 
the  various  ways  in  which  the  aircraft  can  fail  to  te  main- 
tained in  the  required  mode  of  flight  or  fail  to  perform  its 
missicD.  These  failure  modes  are  constituted  by  the  less 
of,  or  serious  degradation  of,  structural  integrity,  power, 
flight  control  or  mission  required  equipment,  or  lift. 
Failure  modes  are  established  for  a  given  aircraft  and 
missicn  with  respect  to  preestablished  minimum  requirements 
for  performance  of  the  aircraft  and  are  related  to  the  crit- 
ical components  of  the  aircraft.  Some  of  the  most  iiipcrtant 
ones  are  listed  in  Table  1  and  described  below.  The  order 
of  the  systems  listed  is  indicative  of  their  ccntributicn  to 
the  total  aircraft  vulnerabilit 3. 

(1)  Zii§l  System  Kill  Modes.  The  following  is 
a  listing  and  brief  description  of  the  potential  fuel  system 
kill  modes. 

I!li§i  Supply  Depletion.  This  kill  mode  is 
caused  either  by  danage  to  fuel  storage  components  that 
results  in  excessive  leakage  leading  to  a  significant  reduc- 
tion in  the  amount  of  fuel  available  for  aircraft  operation, 
or  by  damage  to  fuel  pumping  and  transfer  systems  that 
prevents  fuel  from  reaching  the  engine  (s). 

lUzl^HK  Zi£§  and  Explosion.  Fire  and 
explosion  can  be  caused  by  the  ignition  of  the  fuel-air 
mixture  in  the  ullage  by  incecdiary  particles  or  by  a  hot 
tank  wall.  The  in-tank  fire  or  explosion  can  cause  substan- 
tial damage  to  the  tankage  and  adjacent  structure  and  compo- 
nents, and  the  fire  may  quickly  spread  to  other  parts  of  the 
aircraft. 

l9.i^   Space  Fire  and   Explosion .    This  can 

te   caused  by   fuel  leakage   into   void  spaces   or  dry   bays 

(adjacent   to   punctured   fuel   tanks   and   lines)   that   is 
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subseguently  ignited  hy  incendiary  particles,  by  hot  retal 
surfaces,  or  by  the  hot  gases  from  punctured  bleed  air  lines 
or  engine  cases.  Fire  or  explosion  in  the  enclosed  spaces 
can  eventually  cause  significant  damage  to  nearby  subsystem 
components  and  structure  that  wculd  result  in  their  failure. 
The  generation  of  smcke  and  tciic  fumes  may  also  occur  and 
migrate  to  crew  stations,  causing  a  possible  mission  abort, 
forced  landing,  or  aircraft  abardonment. 

Sustained  Exterior  Fuel  Fire.  This  kill 
mode  is  caused  by  damage  to  fuel  tank  walls  resulting  in 
fuel  spillage  onto  the  extericr  of  the  aircraft  which  is 
subsequently  ignited,  producing  a  sustained  fire.  Sometimes 
the  exterior  fire  is  snuffed  cut  by  the  airflow  over  the 
surface;  however,  the  conditio!  of  the  damaged  surface,  the 
altitude,  and  the  flight  speed  may  prevent  this  from 
cccuring. 

Hydraulic  Ram.  Damage  to  container  walls 
or  components  within  the  container  caused  by  the  intense 
pressure  waves  generated  in  the  contained  liquid  by  penetra- 
tors  cr  fragments  passing  through  the  liquid  is  referred  to 
as  hydraulic  ram  damage.  The  fluid  pressure  can  cause  large 
cracks  and  gaping  holes  in  the  container  walls,  leading  to 
excessive  leakage  either  exterrally  or  internally  into  dry 
bays,  engine  inlets,  etc.. 

(2)  Propulsion  S;xstem  Kill  Modes.  The 
following  kill  modes  of  the  propulsion  system  have  been 
observed. 

Zlif2  Ingestic  I.  Fuel  ingestion  is  caused 
by  fuel  entering  the  engine  air  inlet  following  rupture  of 
walls  that  are  common  to  both  a  fuel  tank  and  the  inlet. 
Fuel  ingestion  effects  normally  include  compressor  surge, 
severe  stall,  unstable  burninc  in  the  tail  pipe,  and/or 
engine  flameout. 
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Foreign  Object  Ingestion .  Foreign  objects 
consist  cf  projectiles,  fragments,  and  pieces  of  damaged 
aircraft  components  which  enter  the  engine  inlet  and  sutseg- 
uently  damage  the  fan  and  ccmjressor  blades.  This  could 
cause  an  engine  failure  or  the  throwing  of  blades  through 
the  engine  case,  leading  to  additional  component  damage. 

Inlet  Flow  Distortion.  Distortion  cf  air 
flow  to  the  engine  can  be  so  severe  as  a  result  of  combat 
damage  to  the  inlet  that  uncoEtrollable  engine  surging  cr 
engine  failure  occurs. 

Lubrication  Starvation.  Penetrator,  frag- 
ment, or  fire  damac€  to  the  lubrication  circulation  and 
cooling  subsystem  can  result  in  loss  of  lubrication  and 
subsequent  deterioration  of  bearing  surfaces,  followed  by 
engine  inoperabili ty .  loss  of  lubrication  failures  are  most 
often  related  to  the  bearings,  where  loss  of  heat  removal 
eventually  results  in  bearing  seizure. 

Compressor  Case  Perforation  or  Distqrticn. 
This  kill  mode  is  caused  by  peretrator  or  fragment  penetra- 
tion through  the  case,  by  distortion  of  the  case,  cr  by 
damaged  ccnipressor  blades  exitirg  through  the  case. 

Combust or  Case  Perforation.  Pen et rater  or 
fragment  penetration  and  holing  of  the  combustor  case,  with 
subsequent  hot  gas  emission  or  torching  through  the  hole, 
can  cause  secondary  damage  effects,  such  as  severe  heating 
of  adjacent  fuel  tanks  or  contrcl  rods,  and  can  also  cause  a 
combustion  pressure  drop  that  nay  result  in  a  significant 
loss  cf  engine  power. 

Turbine  Section  Failure.  Turbine  failure 
can  be  caused  by  penetrator  or  fragment  damage  to  the 
turbine  wheels,  blades,  and  case.  This  results  in  a  loss  of 
engine  power  or  secondary  perforation  and  possible  fire 
damage. 
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Exhaust  Duct  Failure.  Penetration  by 
penetratcrs  and  fragnents  into  the  exhaust  duct  may  result 
in  damage  to  nozzle  control  lines  and  actuator  mechanisms 
and  possible  fuel  spillage  and  secondary  fire  if  an 
augmentor  is  operating  at  the  time  of  the  hit. 

Infills  Controls  and  Accessories  failure. 
A  kill  of  the  controls  and  accessories  can  be  caused  by 
penetratcr,  fragment,  or  fire  damage.  The  result  can  be 
loss  of  control  of  the  engine  cr  loss  of  one  of  the  impor- 
tant accessories. 

(3)   Flisii   Control  System   Kill  Modes.     Some 
possible  flight  control  kill  modes  are  listed  below. 

Disruption  cf  Control  Signal  Path. 
Severence  or  jamming  of  the  mechanical  or  electrical  path 
that  trarsmits  the  control  signals  from  the  pilot  to  the 
control  surfaces  or  the  actuators  can  partially  cr  totally 
incapacitate  the  control  system. 

Los^  of  Contr cl  Power.  Control  power  can 
be  lest  as  a  result  of  damage  to  hydraulic  power  components 
which  causes  a  loss  cf  hydraulic  pressure.  Types  of  power 
system  damage  are  thermal  degradation  due  to  fire,  perfora- 
tion of  hydraulic  reservoirs,  cylinders,  or  lines  leading  to 
a  loss  cf  hydraulic  fluid,  ard  deformation  of  hydraulic 
components,  actuators,  or  lines  that  cause  a  hydraulic  lock 
or  jammed  condition. 

Loss  of  Aircraft  Motion  Data.  Damage  to 
the  aircraft  motion  sensors  or  to  the  sensor  data  signal 
paths  to  the  flight  control  ccnputer  can  prevent  the  auto- 
pilot and  the  stability  augraertation  system  from  properly 
controlling  the  motion  of  the  aircraft.  The  results  can 
vary  from  a  partial  loss  of  control,  leading  to  a  mission 
abort,  to  the  loss  of  an  out-cf -control  aircraft.  These 
components  are  relatively  soft  and  are  easily  damaged  or 
severed  ty  penetrators,  fragments,  and  fire. 


54 


Damage  to  Ccntrol  Surfaces  and  Hinges. 
Penetrators,  fragments,  blast,  and  fire  damage  can  result  in 
the  physical  removal  of  a  porticn  or  all  of  a  flight  ccntrol 
surface  cr  in  the  jacming  of  the  hinges,  rods,  and  ether 
linkages  tetween  the  servcactuators  and  the  ccntrol 
surfaces. 

Hydraulic  FluM  Fire.  Fires  can  result 
from  the  ignition  of  pressurized  or  gravity-leaked  hydraulic 
fluid,  and  smoke  or  tcxic  fumes  from  the  fire  can  affect  the 
crew. 

(4)   Power   Train    and   Rotor    Blade /Propeller 
System  Kill   Modes.    Some  of  the   possitle  kill 
modes  within  the  power  train  and  rotor  blade  system  of  heli- 
copters  and   propeller   driver,   fixed-wing   aircraft   are 
descrited  below. 

Loss  of  Lubrication.  This  kill  mode  can 
occur  due  to  projectile  or  fragment  perforation  of  oil  or 
grease  containing  components,  with  subsequent  loss  of  lubri- 
cation oil  or  grease.  Lubrication  starvation  is  especially 
critical  in  oil-cooled  helicopter  transmissions,  where  the 
oil  systems  are  not  self-contained  and  usually  consist  of 
externally  mounted  components,  such  as  sumps,  filters, 
coolers,  and  interconnecting  lines  and  hoses.  Loss  of 
lubrication  prevents  the  removal  of  heat  and  lubrication  of 
rubbing  surfaces,  which  eventually  results  in  ccmpcnent 
seizure.  In  helicopter  transmissions  and  gear  boxes,  fail- 
ures are  often  catastrophic,  causing  case  rupture  and  fire 
after  input  pinion  failures  and  rotor  blade  seizure  after 
planetary  assembly  failures. 

Mechanical/St luctural  Damage.  Mechanical 
or  structural  failure  of  power  train  components  can  be 
caused  by  fragment  and  penetratcr  inpact  or  penetration,  or 
by  fire.  Bearings,  gears,  ard  shafts  are  prone  to  damage 
and  failure  when  hit,   shafts   can  be  severed,   and  hearings 
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and  gears  can  jam.  Chips  and  debris  from  damaged  compcnents 
or  structure  can  jam  the  oil  punp,  causing  loss  of  lubrica- 
tion, Eotor  blades  and  propellers  when  hit  can  result  in 
rotor  untalance,  blade  instability,  blade  out-of -track,  and 
loss  of  lift.  Eotor  unbalance  is  perhaps  the  most  critical 
consequence  of  ballistic  damage  and  occurs  when  a  portion  of 
the  blade  is  removed.  This  less  of  mass  in  one  blade  can 
cause  large,  alternating  hub  forces  and  intense  cockpit  and 
control  vibrations,  leading  to  structural  failure  or  loss  of 
control.  Blade  instability  is  caused  by  a  reduction  of 
blade  stiffness  due  to  damage  and  can  result  in  severe 
flutter  cr  divergent  pitch  oscillation  that  can  be  cata- 
strophic. Blade  out-of-track  is  usually  a  less  severe 
result  cf  the  reduction  of  blade  stiffness,  but  it  could 
result  in  blade  contact  with  the  fuselage.  Although  scire 
loss  of  lift  normally  accompanies  any  ballistic  damage,  the 
consequences  are  usually  not  as  catastrophic  as  those  asso- 
ciated with  the  other  types  of  tlade  reactions. 

(5)  Crew  System  Kill  Modes.  The  inability  of 
the  pilot  and  his  or  her  replacement  to  operate  the  aircraft 
because  cf  injury,  incapacitation,  or  death  will  usually 
lead  to  an  aircraft  kill  in  a  very  short  period  of  time. 

(6)  Structural  System  Kill  Modes.  The  struc- 
tural system  is  usually  the  toughest  system  on  the  aircraft. 
However,  structural  damage  car  be  sufficient  to  cause  an 
aircraft  kill.  Some  possible  structural  kill  modes  are 
listed  below. 

Structure  Removal.  Physical  severence  or 
complete  loss  of  large  portions  of  the  load-carrying 
aircraft  structure  caused  by  multiple  penetrators  and  frag- 
ments, blast,  fire,  or  radiation  effects  can  result  in 
either  an  immediate  cr  a  delayec  aircraft  loss. 

Pressure  Overload.  Immediate  failure  or 
subsequent  failure   urder  maneuver   loads  can   be  caused   by 
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external  tlast  effects  which  result  in  over-stressing  the 
load  carrying  structure. 

Thermal  Weakening.  Structural  failure  can 
occur  to  portions  of  the  load-carrying  structure  as  a  result 
of  internal  void  space  fires,  externally  sustained  fires,  or 
radiation  over  a  portion  of  the  aircraft  surface. 

Peretration.  A  single  penetration  of  one 
load-carrying  member  will  usually  not  cause  structural 
failure;  several  memters  must  be  penetrated  or  cut  befcre 
failure  can  occur.  Since  the  likelihood  of  structural 
failure  from  penetration  by  a  few  fragments  cr  armcr- 
piercing  projectiles  is  extremely  small,  this  type  of 
failure  would  most  likely  result  from  continuous  rod  warhead 
effects. 

(7)  Electrical  Power  System  Kill  Modes.  The 
failure  of  electrical  system  components  is  due  to  the 
severing  or  grounding  of  electrical  circuits,  the  destruc- 
tion or  unbalancing  of  rotating  components,  such  as  genera- 
tors and  alternators,  and  the  penetration  or  overheating  of 
batteries. 

(8)  Armament  System  Kill  Modes.  Two  major 
reactions  can  occur  when  gun  amnunition,  bombs,  rockets,  and 
missiles  are  hit  by  a  damage  mechanism.  One  is  a  sustained 
fire  in  the  magazine  that  could  cause  cook-off  or  detonation 
of  the  stored  ammunition,  and  the  other  is  a  severe  explo- 
sion of  either  the  arnament  or  the  propellant. 

(^)  Avicnics  System  jSill  Modes.  Avionics 
components  are  usually  very  soft  and  are  easily  damaged  by 
penetrators  and  fragments,  blast,  radiation,  and  thermal 
hazards,  such  as  fire  or  hot  gas  torching.  Their  kill  mode 
is  usually  failure  to  operate,  although  a  degraded  operation 
is  possible. 
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e.   Fault  Tre€  Analysis  (FTA) 

As  descrited  in  the  preceding  section,  the  FMEA 
is  a  tottoffl-up  approach  to  determine  an  aircraft's  critical 
components.  In  the  FMEA,  the  failure  of  a  component  is 
assumed  and  the  consequences  of  that  failure  are  identified. 
Another  procedure  for  identifyirg  critical  components  is  the 
Fault  Tree  Analysis.  The  FTA  is  a  top-down  approach  which 
starts  with  an  undesired  event  and  then  determines  what 
event  or  combinaticn  of  events  can  cause  the  undesired 
event.  The  Fault  Tree  Analysis  is  one  of  the  principal 
methods  of  system  safety  analysis,  and  can  include  both 
hardware  failures  and  human  effects.  The  generic  fault  tree 
diagram  shewn  in  Figure  2.7  demcnstrates  the  logic  symbclogy 
used  in  the  Fault  Tree  Analysis. 

The  undesired  event  D  can  only  occur  when  event 
A  and  event  B  occurs.  (This  is  the  logical  AND  gate).  Event 
A  can  occur  when  event  C  or  evert  D  occurs,  or  if  both  event 
C  and  event  D  occurs.  (This  is  the  inclusive  OE  gate) . 
Event  B  can  occur  when  event  E  or  event  F  occurs,  but  not 
when  both  event  E  and  event  F  occurs.  (This  is  the  exclusive 
CR  gate)  .  Because  tie  undesired  events  of  interest  here  are 
failures  caused  by  (damage,  the  FTA  will  be  referred  to  as 
the  Damage  Tree  Analysis. 

A  portion  of  a  damage  tree  diagram  for  a  twin- 
engine  aircraft  with  a  single  fuel  supply  source  to  both 
engines  is  illustrated  in  Figure  2.8c.  The  undesired  event 
is  an  aircraft  attrition  kill.  An  attrition  kill  occurs  if 
the  aircraft  can  neither  fly  nor  land.  The  aircraft  cannot 
fly  if  it  loses  lift,  or  thrust,  or  control.  Loss  of  thrust 
will  cccur  when  both  engines  fail  or  when  the  common  fuel 
supply  tc  both  engines  fails.  leakage  from  damage  caused  by 
penetration  or  hydraulic  ram  from  the  feed  tank  that 
supplies  fuel  to  both  engines  will   cause  the  fuel  system  to 
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EVENTC 

EVENTD 

EVENT  E 

EVENT F 

Figure  2.7   A  Generic  Fault  Tree  Diagram 

fail.  The  left  ergine  can  fail  due  to  engine  damage  or  the 
loss  cf  the  left  engine  fuel  supply.  The  left  engine  fuel 
supply  system  can  fail  due  to  penetration  of  many  cf  the 
fuel  transfer  componeLts  from  the  feed  tanks  to  the  engine 
combustor,  or  these  components  can  fail  due  to  fire  caused 
hy  leaking  fuel,  leaking  hydraulic  fluid,  or  a  holed  ccmtu- 
stor.  Ihe  left  engine  can  fail  due  to  damage  caused  by  fuel 
ingestion,  penetraticn  of  the  engine  compressor,   combustor. 
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or  turbine,    loss  of  lubricdticn,    fire  caused   by  leaking 
fuel,  or  damage  to  the  engine  ccntrols  or  accessories. 

f.   Kill  Trees  and  Kill  Expressions 

Results  cf  the  stefs  described  above  leads  to 
the  identification  of  a  set  cf  critical  components  in  a 
particular  aircraft  design,   for  a  specific  operational  mode 
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Figure   2.8a        Portion   of   a   Damage   Tree  Diagram 
for    a   Twin    Engine    Aircraft 
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Figure  2.8c    Portion  of  a  Eamage  Tree  Diagram  Cont'd 

and  selected  kill  level.  Each  critical  component  either 
makes  a  singular  contribution  to  an  essential  function  or 
each  ccmjonent  is  one  of  two  or  more  redundant  ccmpcnents, 
each  of  which  can  lake  the  necessary  contribution.  The 
distinction  between  nonredundant  critical  components  and 
redundant  critical  components  is  extremely  important  and 
will  te  demonstrated  in  the  following  sections. 


62 


(1)  TY^ical  Critical  Components.  For  a  two 
engine,  single  pilot  helicopter,  the  following  nonredundant 
compcnents  are  potential  critical  components  for  an  attri- 
tion kill:  (1)  Flight  control  system  components  (reds,  rod 
ends,  bellcranks,  pitch  links,  swashplate,  hydraulic  actua- 
tors, collective  lever,  and  control  pedals),  (2)  Rotor 
Hade  and  power  train  componerts  (blades,  drive  shafts, 
rotor  heads,  main  transmission,  and  gear  boxes) ,  (3)  Fuel 
system  ccmponents  (fuel  cells,  the  sump,  lines,  and  valves)  , 

(U)  Pilot,  and   (5)  Tail  boom. 

The  followinc  redundant  components  are 
potential  critical  components  for  an  attrition  kill:  (1) 
Propulsion   system  ccnnponents   (engine   and  engine   mounts), 

(2)  Hydraulic  subsystem  compcrents,  and  (3)  Structural 
elements. 

For  a  single  engine,  single  pilot,  fixed- 
wing  aircraft,  some  potential  redundant  and  nonredundant 
critical  components  are:  (1)  Pilot,  (2)  Flight  controls  in 
the  ccckpit   and  the  pitch   axis  flight   control  components, 

(3)  Hydraulic  reservoirs,  high-pressure  lines,  components 
and  actuators,  (4)  All  fuel  tarks,  components,  lines,  and 
shut-off  valves,  (5)  Engine  far,  compressor,  turbine,  and 
combustor  sections,  drive  shaft  and  bearings,  engine  mounts, 
and  the  lubrication  and  fuel  supply  components,  (6)  Major 
structure,  such  as  wing  box  spars,  fuselage  longerons,  and 
the  horizontal  and  vertical  stabilizer  spars  and  attach- 
ments, (7)  External  ordnance  and  the  ammunition  storage 
drum,   (8)   Liquid  oxygen  (lOX)   bottle  and  components,   and 

(9)  Liguid-cooled  avicnics  with  a  flammable  coolant. 

(2)  The  Kill  Tree.  A  visual  illustration  of 
the  critical  components  and  of  the  contribution  of  component 
redundancy  is  provided  by  the  kill  tree.  In  order  to  kill 
the  aircraft  a  complete  cut  through  the  tree  trunk  is 
required.    A  sample  kill  tree  for   a  two  engine,   two  pilot 
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heliccfter  is  shown  iv.  Figure  2.9.  For  example,  according 
to  the  kill  tree  in  Figure  2.S,  a  loss  of  the  pilct  and 
either  the  co-pilot  or  the  co-pilot*s  controls  will  lead  to 
an  aircraft  kill,  as  will  a  less  of  the  drive  train  or  loss 
cf  fuel  feed. 

(3)  The  Kill  Expression.  The  relationship 
tetween  component  loss  and  an  aircraft  kill  can  be  expressed 
using  the  logical  AND  and  OB  statements.  This  logical 
expression  is  called  the  kill  eipression.  As  an  example,  a 
portion  of  the  kill  expression  for  the  kill  tree  depicted  in 
Figure  2.9  is  given  ty: 

[  (Pilot   .OR.   Pilot  Contrcls)   .AND.   (Copilot 
.OE.   Copilot  Controls)  ]   .OR.   (Engine  1   .AND. 
.OR.    (Drive  Train)    .CB.    etc. 

C.   VULNERABILITY  ASSESSMENT 

^  •   Defining  a  Vulnerabilit  7  Assessment 

A  vulnerability  assessirent  is  the  process  of  deter- 
mining numerical  values  for  the  measures  of  vulnerability. 
Target  vulnerability  analysis  is  a  scientific  discipline 
involving  both  experimental  and  analytical  processes. 
Preliminary  theories  which  attenpt  to  describe  the  response 
of  a  target  to  a  particular  threat  is  accomplished  during 
the  analysis.  Experimentaticr  provides  the  data  used  to 
corroborate  or  repudiate  the  theories  developed  during  anal- 
ysis. Target  vulnerability  concepts  are  based  or  funda- 
mental physical  principles.  These  principles  include  the 
theory  of:  hydraulic  ram,  icnition,  crack  propagation, 
engine  response  to  fuel  ingestion,  and  structural  response 
to  blast  and  penetration.  Vulnerability  assessments  may  be 
carried  out  entirely  "by  hand",  or  one  or  more  computer 
programs  may  be  used.  Assessments  are  usually  conducted  to 
help  the  designer  evaluate  the  \ulnerabili ty  of  a  design,  or 
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more  impcrtantly ,  by  the  militaiy  to  predict  the  response  of 
targets  to  a  particular  threat  before  threat  and  target 
engagenieDt . 

A  vulnerability  assessment  is  carried  out  at  one  of 
three  general  levels  cf  detail.  These  levels  are  estimates, 
evaluations,  and  analyses.  Mcst  assessments  consider  five 
fragment  impact  velocities  frcn  1000  to  10,000  ft/sec  and 
use  as  a  minimum,  the  six  cardinal  aspects-  For  a  minimum 
level  assessment,  the  six  major  aspects  shown  in  Figure  2.10 
are  usually  considered  for  each  kill  level.  The  26  aspects 
depicted  in  Figure  2.11  are  usually  considered  when  a  mere 
detailed  analysis  cr  a  computer  analysis  is  performed. 
Estimates  typically  use  simple  equations  for  the  aircraft 
vulnerahility  measures  that  are  functions  of  a  few  major 
parameters.  These  equations  are  referred  to  as  regression 
equations  if  they  are  fitted  tc  historical  data  on  several 
aircraft  or  to  the  results  from  engineering  studies. 
Evaluations  are  more  detailed  than  estimates  and  may  include 
such  items  as  the  individual  coirponent  locations,  sizes,  and 
vulnerability  measures.  Analyses  are  very  detailed  assess- 
ment studies  that  use  specific  technical  and  functional 
information  about  the  componerts  and  their  vulnerability. 
Analyses  are  usually  conducted  on  a  digital  computer  using 
complex  geometric  target  models. 

2  •   lJ3iil££§.^ili:i:J  Measures 

Because  of  the  diverse  nature  of  the  hostile  envi- 
ronment in  which  aircraft  operate,  the  measures  of  the 
vulnerability  of  an  aircraft  vary  with  the  type  of  threat 
encountered.  For  example,  if  a  hit  on  the  aircraft  must 
occur  in  order  for  a  threat  to  be  effective,  such  as  a  small 
arms  projectile  and  a  contact- fuzed  high  explosive  warhead, 
one  measure  of  vulnerability  is  the  conditional  probability 
the  aircraft  is  killed   given  a  random   hit  on  the  aircraft. 
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P    .    Another  measure  of  vulnerability  to  impacting  damage 

K/ H 

mechanisms  is  the  aircraft's  vulnerable  area,  A^ . 
Vulnerable  area  is  a  theoretical,  non-unique  area  presented 
to  the  threat  which,  if  hit  tj  a  damage  mechanism,  would 
result  ir  an  aircraft  kill.  Cr  the  other  hand,  when  damage 
is  caused  by  the  effects  of  a  rearby  high  explosive  detona- 
tion, the  vulnerability  may  be  expressed  in  the  form  of  a 
P  (probability  of  kill  given  a  detonation)  envelope. 
This  envelope  represents  a  kill  probability  contour  about 
the  aircraft  on  which  a  specified  detonation  will  result  in 
a  certain  probability  of  aircraft  kill.  If  only  the  blast 
from  the  exploding  warhead  is  considered,  the  envelope 
represents  the  aircraft's  vulnerability  to  external  blast. 
A  measurement  which  is  becoming  more  important  relates  to 
aircraft  vulnerability  to  a  laser  threat.  Laser  vulner- 
ability can  be  measured  by  the  probability  of  kill,  given  a 
specific  power  laser  lock-on  for  a  specified  period  of  tine, 
F 

K/Lo 

3 .   General  Requirements 

Certain  required  elements  of  a  vulnerability  assess- 
ment are  common  to  all  studies,  regardless  of  the  type  of 
threat  considered.  These  elements  are:  (1)  a  selection  of 
the  aircraft  kill  levels  or  categories  to  be  assessed,  (2) 
an  assembly  of  the  technical  a rd  functional  descriptions  of 
the  aircraft,  (3)  a  determination  of  the  critical  components 
of  the  aircraft,  (U)  a  selecticr  of  the  specific  threats  the 
system  will  encounter,  (5)  an  analysis  to  identify  the  type 
and  amount  of  damage  required  to  kill  each  critical  compo- 
nent, and  (6)  the  computatior  of  the  appropriate  vulner- 
ability measures  for  the  components  and  the  aircraft  based 
upon  the  threat  selected.  The  first  three  steps  of  the 
assessment  have  been  described  in  the  preceding  section.  A 
presentation  of  the  last  three  steps  follows. 


a.   Threat  Selection 

Because  of  the  many  diverse  and  terminal  effects 
of  the  various  damage  mechanisis,  each  vulnerability  assess- 
ment is  usually  made  considerinc  either  a  specific  threat  or 
a  specific  damage  mechanism.  Mechanisms  which  may  cause 
damage  to  an  aircraft  may  be  classified  as:  kinetic  energy 
penetratcrs  such  as  projectiles  and  fragments,  internal  and 
external  blast,  pyrcphorics,  shaped  charged  jets,  focused 
blast  fragments  and  lasers. 

Kinetic  energy  penetrators  include,  but  are  not 
limited  to,  ball  projectiles,  armor  piercing  projectiles, 
and  fragments.  These  penetratcrs  cause  damage  to  aircraft 
components  during  penetration  and  perforation.  Armor 
piercing  projectiles  are  constructed  with  a  hardened  core 
which  enhances  the  penetratioE  characteristics  of  these 
projectiles  over  those  of  the  lall  type.  Most  small  armor 
piercing  projectiles  are  prone  to  tumbling  after  impact 
thereby  increasing  the  size  of  the  hole  that  they  tear  in 
the  internal  components. 

Armor  piercing  incerdiary  projectiles  contain  an 
incendiary  nix  encased  within  the  nose  of  the  projectile 
ahead  of  a  hardened  case.  Upon  impact  the  jacket  peels  off, 
and  the  incendiary  material  flashes  as  the  projectile  core 
penetrates  the  target. 

Large  high  explosi^ie  projectiles  and  missiles 
can  be  equipped  with  influence  cr  command  fuzes  causing  them 
to  detonate  nearby  an  aircraft.  These  projectiles  or 
missiles  have  the  capability  of  inflicting  damage  from 
external  blast  effects,  fragment  impact  effects,  or  a  combi- 
nation of  both. 

Many  smaller  high  explosive  projectiles  are 
equipped  with  delay  fuzes.  These  fuzes  initiate  upon 
contact  with  the   aircraft  skin  and  detonate   the  projectile 
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liithiE  the  aircraft.  This  high  explosive  detonation 
produces  internal  blast  and  fragmentation  effects.  These 
fragments  usually  are  smaller  and  slower  than  the  larger 
high  explosive  projectiles  but  the  proximity  of  the  detona- 
tion to  the  critical  components  results  in  a  spray  of  many 
fragments  impacting  the  components.  This  combination  of 
internal  blast  and  fragmentation  effects  is  especially 
lethal  to  lightly  ccEstructed  components  such  as  oil  and 
fuel  lines,  oil  and  fuel  tanks,  hydraulic  tanks,  and  the 
aircre*. 

b.   Critical  Component  Fill  Criteria 

Once  the  set  of  critical  components  for  a  given 
aircraft  has  been  identified,  the  damage  or  kill  criteria 
for  each  of  the  failure  modes  of  these  components  must  be 
determined  for  the  selected  threats.  Damage  criteria  for  a 
critical  component  is  the  level  of  damage  required  for  a 
preestablished  degradation  of  the  performance  of  the  compo- 
nent. Thus,  a  kill  criterion  is  the  specific  descriptive 
characteristics  or  quantification  of  a  component  failure. 
Some  examples  of  critical  compcrent  kill  criteria  are:  the 
amount  of  material  that  must  b€  removed  from  a  drive  shaft 
for  failure,  requirements  fcr  failure  of  a  structural 
member/  the  amount  cf  damage  required  to  incapacitate  a 
system  of  gears,  the  minimum  diameter  of  hole  in  a  fuel  tank 
or  line  for  engine  starvaticr  within  a  specified  time 
period,  etc.  Very  few  kill  criteria  are  precisely  known, 
nor  can  they  easily  be  determired.  Battle  damage  reports 
are  an  important  source  of  component  damage  effects  infcrma- 
tion.  The  results  of  tests  conducted  on  all  types  of 
aircraft  components  and  subsystems  provide  another  increas- 
ingly important  and  expanding  source  of  data.  Data  is 
required  for  each  critical  conponent  that  allows  for  the 
effects  cf  encounter  parameter  -sariations,   such  as  fragment 


71 


or  penetrator  striking  velocity,  obliquity  angle,  shape  and 
mass  cf  the  fragment  cr  penetrator,  to  be  estimated  for  each 
kill  category  and  level  being  assessed.  In  the  case  of 
externally  detonating  warheads,  high  explosive  projectiles, 
and  contact-fuzed  lissiles,  miss  distance  boundaries 
relating   P    to  burst  points   are   established  to   assess 

K/H 

blast  effects  of  these  threats. 

The  major  result  of  this  task  is  the  specifica- 
tion of  numerical  values  for  the  kill  criteria  for  each 
failure  node  for  each  critical  component  for  each  threat  to 
be  considered.  Three  specific  kill  criteria  are  currently 
in  use  fcr  the  impacting  damage  mechanisms.  They  are  the 
probability  of  component  kill  given  a  hit,  the  area  removal 
criterion,  and  the  energy  density  criterion.  There  is  a 
fourth  criterion  which  applies  to  the  blast  damage 
mecharisirs. 

C)  The  Probability  of  Kill  Given  a  Hit 
Function.  The  P^/h  function  defines  the 
probability  of  a  component  kill  when  impacted  by  a  fragment 
cr  penetrator.  This  criterion  can  be  presented  graphically 
as  a  function  of  the  irass  and  velocity  of  the  damage  mecha- 
nism, or  it  can  be  expressed  in  an  analytical  form.  Figure 
2.12  is  a  sample  of  P]^/^  data  fcr  a  flight  control  red. 

The  \/-^  criterion  is  normally  used  for 
components  that  can  be  killed  bj  a  single  hit,  such  as  crew 
members,  control  rods,  electronic  equipment,  and  servoactua- 
tors.  These  components  are  sc netimes  referred  to  as  single 
fragment  vulnerable  components.  It  can  also  be  used  for 
some  cf  the  larger  components,  such  as  engines  and  fuel 
tanks.  In  this  case,  the  volume  of  the  large  component  is 
usually  divided  intc  several  smaller  volumes,  and  a 
different  numerical  value  of  P,  ,,  is  assigned  to  each 
volume.  For  example,  a  fuel  tank  could  be  divided  into  the 
ullage,   fuel,    and  external  vcid   spaces,   and   a  turbojet 
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engine  cculJ   be  sul-divideJ  ii.  t  c   the  oajor   sections  illus- 
trated in  Figure  2.13. 


The   determination  of   the   P 
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fcr   each 


component  or  part  cf  a  component  is  a  very  difficult  under- 
taking. It  requires  a  combination  of  critical  ccmpcnent 
analysis   data  and   sound   engiteering   judgment.    Although 
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limited  gunfire  testing  provides  some  insight  into  the 
effects  cf  projectile  and  fragment  damage  potential,  there 
is  no  universal  methodology  f cr  arriving  at  a  numerical 
value  for  Pw^  •  The  larger  components,  such  as  the  fuel 
tanks  and  engines,  are  especially  difficult  to  evaluate  due 
to  the  iiultitude  of  local  ervironments,  the  constantly 
changing  operation  conditions,  and  the  many  different 
failure  nodes,  Numhers  for  '^i^/h  ^^^  eventually  assigned 
based  upon  a  combination  of  enpirical  information,  engi- 
neering judgment,  and  experience. 

The  location  of  the  component  inside  the 
aircraft  will  have  ar  influence  on  its  ultimate  numerical 
probability  of  kill  given  a  hit,  but  not  on  its  P^/^  func- 
tion. Components  located  behind  thick  structures  cr  dense 
equipment  packs  will  receive  a  level  of  protection  due  to 
the  slowdown  of  the  damage  mechanism  as  it  attempts  to  pene- 
trate the  shielding  ccmponents.  The  numerical  value  of  the 
^k/h  ^^^  ^^^  lowered  velocity  of  impact  will  generally  be 
less  than  the  P^/h  ^^r  the  impact  of  a  penetrator  cr  frag- 
nent  that  was  not  slewed  down.  Other  considerations,  such 
as  spall  and  fragment  breakup  caused  by  the  intervening 
components  also  becomes  important. 

The  area  renoval  criterion  defines  a 
specific  amount  of  area  that  must  be  removed  from  a  compo- 
nent in  order  to  kill  that  ccnponent.  This  criterion  is 
applicable  to  large  penetrators,  such  as  rods,  and  to  the 
closely  spaced  hits  from  many  fragments.  The  total  compo- 
nent damage  from  a  collection  of  closely  spaced  hits  can  be 
greater  than  the  sum  of  the  individual  damages  from  the  same 
number  of  widely  spaced  hits.  Cften  there  is  a  synergism  of 
damage  due  to  cracking  and  petalling  between  the  individual 
holes,  and  large  areas  of  component  structure  can  he  removed 
or  destroyed.  This  criterion  is  used  mainly  for  structural 
components. 
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(2)  Energy  Densit  7.  In  this  criterion,  a 
component  kill  is  expressed  in  terms  of  a  required  miDimum 
component  surface  area  that  must  be  exposed  to  a  minimum 
threshold  level  of  the  kinetic  energy  density  of  the 
impacting  damage  mechanisms.  Ihis  criterion  is  applicable 
to  closely  spaced  multiple  fragnent  hits  and  is  used  for  the 
structural  components,  as  well  as  other  large  components, 
such  as  the  fuel  tarks  and  engines.  For  some  components, 
there  may  be  a  mininum  mass  of  the  damage  mechanism  telow 
which  the  criterion  is  not  applied. 

(3)  Blast.  The  damage  criterion  for  hlast  is 
generally  the  critical  values  of  pressure  and  impulse  en  an 
aircraft  surface  necessary  to  cause  the  specific  component 
damage  level  associated  with  the  assumed  kill  level.  For 
example,  a  dynamic  overpressure  of  two  pounds  per  square 
inch  ever  the  upper  surface  ci  a  horizontal  tail  for  one 
milliseccnd  may  be  sufficient  te  cause  crushing  of  the  skin, 
leading  to  a  loss  of  stiffness  and  the  inability  to  support 
the  flight  loads.  Although  this  criterion  is  usually 
applied  to  the  structural  components  and  control  surfaces, 
the  effects  of  the  blast  can  extend  into  the  interior  of  the 
aircraft  and  can  damage  electrical  wiring,  hydraulic  lines, 
fuel  tank  walls,  and  ether  internal  components  located  close 
to  the  aircraft  skin. 

c.   Computaticn  of  the  "Vulnerability  Measures 

The  procedures  used  to  compute  the  vulnerability 
of  an  aircraft  and  its  components  to  an  externally  deto- 
nating high  explosive  warhead  and  non-explosive  penetrators 
or  fragments,  to  an  internally  detonating  high  explosive 
warhead,  and  to  lasers  are  described  in  the  following  three 
sections. 
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D.   VDLNEEABILITY  TO  EXTERNALII  DETONATING  WARHEADS 

Vulnerability  of  an  aircraft  to  an  externally  detonating 
high  explosive  warhead  is  usually  analyzed  in  two  steps. 
The  first  step  is  a  determination  of  the  aircraft's  vulner- 
ability to  the  blast,  and  the  second  step  analyzes  the 
aircraft's  vulnerability  to  the  fragments  and  penetrators. 
In  addition,  both  analyses  must  consider  the  encounter  scen- 
ario between  the  aircraft  and  the  missile  at  the  time  of 
warhead  detonation.  For  this  reason,  this  section  has  been 
divided  into  the  following  two  subsections:  the  effect  of 
fragments  and  penetrators  striking  an  aircraft,  and  blast. 
Shortly  after  detonation,  the  blast  front  precedes  the  frag- 
ments. Eventually,  the  fragnents  pass  through  the  blast 
front  because  the  fragment  velocity  decay  is  less  than  the 
blast  front  velocity  decay.  The  overpressure  caused  by  the 
warhead  detonation  can  cause  serious  damage  to  aircraft 
structure  and  components.  Using  the  conditions  of  the 
encounter  scenario,  the  blast  is  analyzed  for  impulse  and 
overpressure  to  determine  iso-damage  contours  for  an 
aircraft  kill.  If  a  detonation  occurs  close  enough  to 
inflict  serious  blast  damage,  the  fragments  most  likely  will 
cause  much  more  damage  than  that  caused  by  the  blast.  In 
the  fragments  and  penetrators  subsection,  the  vulnerability 
to  fragicents  and  penetrators  is  computed  for  both  the  single 
hit  case  and  the  multiple  hit  case.  A  typical  encounter  is 
shown  in  Figure  2.14. 

1*   Effect  of  Fragments/ Penetrators  Striking  an  Aircraft 

The  vulnerability  of  an  aircraft  to  a  single 
impacting  penetrator  or  fragmert  is  usually  expressed  as  a 
total  vulnerable  area.  Ay/  or  as  a  probability  of  aircraft 
kill  given  a  random  hit  on  the  aircraft,  P  k/h •  The  vulner- 
able area  concept  is  applicable  to   both  the  aircraft  and  to 
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Figure  2. 14    Typical  Aircraft  Encoanter  With 
An,  Externally  Detonating  HE  Warhead 
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its  critical  components.  The  vulnerable  area  of  the  typical 
ith  ccicpcnent  is  denoted  by  A  ,  and  the  component  kill 
criterion  used  is  the  probability  of  kill  given  a  hit, 
P,  ,,  ,  To  assist  the  reader  in  keeping  track  of  the  nota- 
tion  used  in  this  presentation,  the  variable  and  subscript 
definitions  are  summarized  in  Table  2. 


TABLE  2 
VDlnerability  Assessment  Variable  Definitions 

Definition 

Probability  of  killing  the  ith  component 
given  a  hit  on  the  ith  compcnent 

Probability  of  killing  the  ith  component 
given  a  hit  on  the  aircraft 

Probability  of  killing  the  aircraft 
given  a  hit  on  tie  aircraft 

Vulnerable  area  of  the  ith  component 

Vulnerable  area  cf  the  aircraft 

Presented  area  of  the  ith  ccmponent 

Presented  area  of  the  aircraft 

Note  that  a  distinction  is  made  between  component 
and  aircraft  designated  variables  by  using  lower 
and  upper  case  subscripts,  respectively. 


Variable 

^k/hi 

^k/H^ 

^K/H 

ivi 

*v 

Ap 

The  vulnerable  area  of  the  ith  component  is  defined 
as  the  product  of  the  presented  area  of  the  compcneit  in  the 
plane  normal  to  the  approach  direction  of  the  damage  mecha- 
nism (the  shotline) ,  A   ,  and  the  probability  of  kill  cf  the 

Pi 
component  given  a  hit  on  the  ccnponent,  P]^/^.  .   Thus, 


A^.  =  A^   X  P^,^  (2.1) 


X 


Pi      k/h^ 
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since  both  A  and  F]^/^.  are  generally  functions  of  the 
threat  direction  or  aspect,  the  vulnerable  area  will  also 
vary  with  aspect.  In  the  discussion  that  follows,  it  is 
important  to  recall  that: 


where   P    is   the  probability   the  aircraft  or   ccmpcnent 

S/H 

survives  the  hit,   and  P     is  the  probability   of  killing 

K/ H 

that  aircraft  or  compcnent. 

The  kill   probability  of  the   ith  component   given  a 
random  hit  on  the  aircraft,  Pj^/h.  /  is: 

\/E^      ^    •^h/H^  ^  \/h^  (2.3) 

where  Ph/n-  ^^  ^^^  prcbability  the  component  is  hit  given  a 
hit  on  the  aircraft,  and  P]^/^.  is  defined  as  the  probability 
the  component  is  killed  given  a  hit  on  the  component.  From 
Iguaticn  2.2,  it  follows  that: 

Ps/H.   =  1  -  Pk/H.  (2.4) 

Using  Equations  2,1  and  2.3,  arc  solving  for  P^/h.  gives: 

Vh.   =  ^p.  /  h  <2.5) 

where  Ap  is  the  presented  area  of  the  total  aircraft  in  the 
plane  normal  to  the  threat  direction.  Substituting 
Equations  2.5  and  2.1  into  Equation  2.3  determines,  for  any 
randoff  hit  on  the  aircraft,  tie  probability  the  ith  compo- 
nent is  killed,  and  is  given  by: 


I^/H.   =  K.     /  Ap  (2.6) 

1       1 
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The  numerical  value  for  P,  ,„  depends  upcr  the 
presented  area  of  the  critical  component,  Ap. ,  and  of  the 
aircraft,  Ap ,  and  upon  the  component  kill  criterion,  Pk/h'  • 
The  presented  area  of  the  critical  components  and  of  the 
aircraft  can  be  obtained  frcm  the  available  techrical 
description  of  the  aircraft.  The  procedure  for  determining 
the  numerical  value  for  P^/h.  is  described  in  the  presenta- 
tion on  the  critical  component  kill  criteria  given  atove. 

In  this  assessment,  a  component  is  assumed  to  be 
either  operating  and  performicg  all  of  its  functions  or 
Tcilled.  No  degradation  of  component  capabilities  is  consid- 
ered due  to  a  hit,  and  no  compounding  of  component  damage  is 
recognized.  Although  these  assumptions  are  usually  made  in 
a  vulnerability  assessment,  they  are  not  necessary. 
Theoretically,  only  the  component  hit  can  be  killed. 
Although  the  kill  of  adjacent  components,  perhaps  by  fire  or 
explosion,  is  not  directly  considered  here,  a  procedure  for 
indirectly  accounting  for  kills  of  adjacent  components  will 
te  described  later. 

Now  that  the  concepts  of  vulnerable  area  and  the 
probability  of  kill  given  a  hit  have  been  explained,  the 
scenario  must  be  considered.  In  any  given  combat  engage- 
ment, the  aircraft  will  either  not  be  hit,  it  will  be  hit 
only  cnce,  or  the  aircraft  will  be  hit  more  than  once.  The 
Eo  hit  situation  is  not  of  interest  here.  The  location  on 
the  presented  area  of  the  aircraft  of  the  single  hit  ard  of 
multiple  hits  is  assumed  in  the  vulnerability  assessment  to 
te  a  random  distribution,  with  each  damage  mechanism  having 
the  same  approach  or  attack  direction.  In  other  words,  the 
assumption  is  usually  made  that  the  enemy  has  no  capability 
to  direct  hits  to  any  one  particular  component,  subsystem, 
or  part  of  the  aircraft,  and  that  the  damage  mechanisms 
travel  along  parallel  shotlines.  The  single  hit  case  lays 
the  ground  work  for  the  multiple   hit  case.    In  both  cases. 
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the  influence  of  nonredundancy  and  redundancy  of  ccniponerts 
on  th€  vulnerable  area  must  be  examined.  Overlap  of  crit- 
ical components  is  also  an  important  consideration. 

a.   Single  Hit  Vulnerability 

Both  the  nonredundant  aircraft  model  and  the 
redundant  aircraft  model  considered  in  this  section  are 
assumed  to  receive  orly  one  hit.  The  nonredundant  aircraft 
model  is  composed  of  only  one  of  each  of  the  critical  compo- 
nents. Thus,  the  less  of  anj  one  critical  component  will 
cause  the  loss  of  the  aircraft.  In  the  redundant  aircraft 
model,  seme  of  the  critical  ccmponent  functions  are  dupli- 
cated by  the  same  or  different  components.  The  effects  of 
overlapping  of  both  nonredundant  and  redundant  critical 
components  are  examined.  For  example,  the  fact  that  an 
engine  overlaps  (shields)  a  hydraulic  pump  will  probably 
decrease  the  probability  of  kill  of  that  pump.  It  is  neces- 
sary to  specify  how  this  overlap  effect  is  quantified  for 
both  the  nonredundant  and  redundant  aircraft  models. 

C)  Aircraft  Model  Composed  of  Nonredundant 
Components  with  No  Overlap.  This  aircraft 
consists  of  N  critical  components  whose  functions  are  not 
duplicated  by  any  other  component.  The  components  are 
arranged  in  such  a  way  that  nc  components  overlap  when 
viewed  from  a  given  aspect.  Any  hit  on  the  aircraft  takes 
place  along  a  shotlire  that  passes  completely  through  the 
aircraft.  Thus,  no  more  than  one  component  can  be  hit  en 
any  one  shotline.  As  an  exanple.  Figure  2.15  shows  an 
aircraft  consisting  of  three  critical  components;  a  pilot, 
one  fuel  tank,  and  one  engine.  None  of  the  critical  compo- 
nents overlap  in  the  aspect  presented  in  Figure  2.15. 

The  probability  of  killing  this  aircraft, 
given  a  random  hit  oe  the  preserted  area  in  Figure  2.15,  can 
be  derived  using   the  kill  expression  and   Eguations  2.  1  and 
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2.6.  Fcr  an  aircraft  composeo  of  N  nonredundant  critical 
components,  the  kill  Gxpressioc  is: 

Kill  =  (Nrcl)   .OR.   (Nrc2)   .OR.   (NrcN)       (2.7) 

vhere  Nici  refers  to  a  kill  of  the  ith  nonredundant  ccmpo- 
nent.  In  other  words  the  aircraft  kill  is  defined  by  the 
kill  of  nonredundant  component  number  1,  or  nonredundant 
component  number  2,  or  -..,  or  nonredundant  component  number 
N.  Because  a  kill  of  any  one  of  the  critical  components 
will  kill  the  aircraft,  the  aircraft  will  survive  only  if 
all  of  the  nonredundant  critical  components  survive.   Thus, 


P     =P     xP      X xE  (2.8) 

S/H      s/H^       s/H^  S/H^ 

Using  Equation  2.4,  Equation  2-£  may  be  written  as: 


...  X   (1  -  P^/hJ 

Eor  our  model  aircraft  N=3,  and  Equation  2.9  becomes: 


(Pu/u    X  P,  ,„  )  +   (J,  .„   X  P,  ,„  )  +  (P,  ,u    x 
Pk/H3  )  -   (Pk/Hi   X  E,,/H2   X  Pk/H3  ) 

Because  of  the  assumption  that  cnly  the  component  hit  can  be 
killed,  and  because  none  of  the  critical  components  overlap, 
the  kills  of  the  components  are  mutually  exclusive.  This 
means  only  one  component  can  be  killed  by  one  hit,  and  the 
products  of  the  Pj^/h.  given  in  Equation  2.10  are  not  appli- 
cable.  Therefore,  Equation  2.1C  simplifies  to: 
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and  the  probability  cf  killing  the  aircraft  given  a  hit  on 
the  aircraft  is  just  the  sum  of  the  individual  probabilities 
of  killing  each  of  the  critical  components  given  a  random 
hit  or  the  aircraft.   This  may  he  written  as: 

Pk/H     =    Vhi      *     Pk/H2      +     ...      +     5k/H^  (2.12) 

Substituting  Equation  2.6  into  Equation  2.8,  and  applying 
the  ccncept  of  Pj^/j^  expressed  ir  Equation  2.1,  leads  to: 

Pk/h  =  *v  /  *p  '2-") 

where  A   is   the  summation  of  vulnerable  area  of   all  of  the 

V 

critical  components. 

For  our  example  aircraft,  the  kill  expres- 
sion is  given  by: 

Kill  =  (Pilot)  .OR.  (Fuel  TaE]<)  .OR.  (Engine)      (2.14) 

From  Equation  2. 12: 


P     =  P     +  P     +  P  (2.  15) 

K/H      k/H        k/H      ^k/H  ^^'     -^' 


and 


A^  =  A^   +  A^   +  A  (2.16) 

P      f     "^e 

where  the  subscripts  p,  f,  and  €  denote  the  pilot,  the  fuel 
tank,  and  the  engine.  From  Equation  2.1,  the  individual 
compccent  areas  are  given  by: 


A^^   =  A   X  P-  .,  (2.  17) 

V       p      k/h  *     ' 

P      ^P        P 


^  P^     k/h, 


A    =  A    X  P  (2.  18) 

f     Pf 
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A    =  A    X  P  ,  ,, 

V       p      k/n 
e      ^e      '    e 


(2.19) 


For  illustration,   a   numerical  example  is 
presented  in  Table  3. 


TABLE  3 

Nonredundant  Model  Without  Overlap 
With  Mutually  Exclcsive  Kill  Modes 


Critical 
Ccmp onent 

Pilot 
Fuel 

Engine 


4  ft2 
60  ft2 
50  ft2 


A   =  300  ft2 

p 


k/h^ 

1.0 
0.3 
0.6 


A   =  52  ft2 

V 


V. 

1 

4   ft2 
18   ft2 

30  ft2 


K/H- 


k/H, 


*"  ■"■"  —  —  — 

.0133 

.0600 

.1000 

=  .  1733 

The  kill  of  ere  critical  component  due  to 
damage  caused  by  a  hit  on  another  critical  component  and  the 
consideration  of  multiple  kill  nodes  of  a  critical  component 
can  be  indirectly  accounted  for,  in  this  model,  by 
increasing  the  numerical  value  cf  the  kill  criterion  for  the 
component  hit.  Consider  two  failure  modes  that  are  not 
mutually  exclusive,  that  is,  hoth  can  occur  with  a  single 
hit.  For  example,  suppose  the  probability  the  fuel  tank  of 
an  aircraft  is  destroyed  by  a  fire  when  the  fuel  tar.k  is 
hit,  is  taken  as  0.3.  Suppose  further  that  the  probability 
that  the  fuel  tank  is  penetrated  and  that  hydraulic  ram 
damage  causes  fuel  to  be  dumped  into  the  air  inlet  and 
ingested  by  the  engine,  leadirg  to  an  aircraft  loss,  is 
taken  as  0.1.    The  aircraft  will   survive  a  hit  ir  the  fuel 
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tank  cnly  if  there  is  neither  a  fire  nor  any  fuel  ingestion. 
The  prohability  that  neither  of  these  failure  modes  occur 
when  the  fuel  tank  is  hit  is  given  by  the  product  of  the 
probatility  that  there  is  no  fire  (1  -  0.3)/  and  the  prob- 
ability that  there  is  no  fuel  ingestion  kill  of  the  engine 
(1  -  0.1),  which  is  0.63.  Therefore,  the  probability  that 
there  will  be  a  fire  kill  anc/or  a  fuel  ingestion  kill, 
given  a  hit  on  the  fuel  tank,  is  given  by  (1  -  0.63)  ,  or 
C.37.   A  numerical  example  is  presented  in  Table  4. 


TABLI  4 

Nonredundant  Model  Without  Overlap 
With  Mutually  Inclusive  Kill  Modes 


Critical 
Component 

A 

___Pi_ 

X 

p 

k/hi 

" 

A 

P 

k/Hi 

Pilot 

a  ft2 

1.0 

H.O    ft2 

.0133 

Fuel 

60  ft2 

0.3-; 

22.2  ft2 

.0740 

Engine 

50  ft2 

0.6 

30.0  ft2 

.1000 

Ap  =  300 

ft2 

s 

=  56.2 

ft^        ^K/H  = 

.1873 

Note  that   in  this  case   the  P  ,     is  net 

k/h 

the  sum  of  the  two  individual  kill  probabilities  because 
there  can  be  both  a  fire  kill  and  a  fuel  ingestion  kill  on 
the  one  hit.  Comparing  Table  3  with  Table  4  shows  that  by 
accounting  for  the  additional  failure  mode  of  fuel  irgestion 
by  the  engine  increases  the  fuel  tank  \/y^  with  the  acccmpa- 
nying  change  in  component  and  aircraft  vulnerable  area,  and 
the  component  and  aircraft  probability  of  kill.  This  same 
procedure  can  be  used  to  compute  the  ?  j^/^ .  due  to  multiple 
failure  modes  of  one  critical  component. 


(2)  Aircraft  Model  Composed  of  Nop  redundant 
Com  t:  Clients  with  Overlap.  The  aircraft 
model  will  now  be  expanded  by  allowing  two  or  more  critical 
components  to  overlap  in  an  arbitrary  manner.  An  example 
aircraft  is  presented  in  Figure  2.  16.  There  can  be  any 
number  of  critical  ccmponents  along  a  shotline  within  the 
overlap  area.  For  the  aircraft  to  survive  a  hit  alcng  a 
shotline  within  a  region  of  N  overlapping  critical  compo- 
nents, each  critical  component  along  that  shotline  must 
survive.  The  probability  the  aircraft  survives  a  hit  on  the 
overlap  region,  ^  /u     *    ^^   given  by: 

s/h^      s/h-j^     s/n2  ^/"n 

Because  two  or  more  critical  components  in  the  overlap 
region  can  be  killed  by  one  hit,  the  kills  of  more  than  one 
compcnent  are  not  lutually  exclusive.  In  this  case. 
Equation  2.11  is  not  valid,  and  Equation  2.20  must  be  used 
for  hits  in  the  overlap  region.  For  the  aircraft  illus- 
trated in  Figure  2.16,  the  probability  the  aircraft  survives 
a  hit  on  the  overlap  region  is  given  by  Equation  2.21,  where 
the  subscripts  f  and  e  refer  to  the  fuel  tank  and  the 
engine. 


P  ,^   =  P  ,,   X  P  .,  (2.21) 

s/h^      s/h^     s/hg  ' 

If  the  overlaj  area,   A   ,   is  new  consid- 

Po 
ered  as  a  separate  ccaponent,   the  probability  of  kill  given 

a  hit  on  the  component  may  be  written  as: 


Pk/h   =  1  -  PsA  <2.22) 

^  o  o 
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and  the  vulnerable  area  of  the  overlap  area^   A^  ,   is  given 
ty: 

A    =  A    X  P  (2.23) 

Vq       Po      ^/^o 

Substituting  Eguation  2.21  intc  Eguation  2.23,    and  using 
Equation  2.4,  gives: 


o  f  '    e 

It  is  assumed  for   this  example   that  the 
overlap  area  in  Figure  2.16  is  10  ft^,  the  fuel  tank  F  ,^/y^  is 

0.3/   the  engine   P,  „   is  0.6,   and  all  other  areas  arc  the 

^        k/h 

same  as  used  in  the  nonoverla jping  example.  The  fuel  is 
assumed  tc  slow  the  damage  mechanism  down,  but  not  enough  to 
change  the  engine  P]^/}^  .  Because  the  P^/h  values  are  the 
same  as  in  the  nonoverlapping  example,  any  reduction  ir  the 
vulnerable  area  of  tie  aircraft  is  due  only  to  the  component 
overlap.   Thus,  in  the  overlap  region: 


^k/h   =  ''  "  [(1-0-3)  X  (1-0.6)]  =  0.72  (2.25) 


and 


A    =  10  X  0.72  =  1.2  ft2  (2.26) 

according  to  Equations  2.23  and  2. 24. 

The  vulnerable  area  of  the  overlap  area 
contributes  to  the  aircraft  vulrerable  area.  However,  over- 
lapping also  requires  that  the  overlap  area  be  subtracted 
from  the  total  presented  area  cf  each  overlapping  component 
contributing  to  the  overlap.  The  component  area  outside  of 
the  overlap  is  treated  in  the  usual  way.  Table  5  illus- 
trates computing   the  vulnerable   area  of   an  aircraft   with 
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overlappicg  components.  Note  that  locating  two  of  the  crit- 
ical conijonents  such  that  one  overlaps  the  other  reduces  the 
aircraft  vulnerable  area  form  52  ft^  to  50.2  ft^.  This  is 
an  example  of  how  location  of  the  critical  components  can 
reduce  tie  aircraft's  vulnerable  area. 


TABLE 

5 

"Vulnerable  Area  Computati< 
Model  With  Overlap  aid 

Dn 

N 

for 
o  Eng 

Nonredundant 
ine  Fire 

Critical 

Ccicfcnent 

'Pi 

z 

Pk/h. 
1.0 

— 

Av. 

1 

Pilot 

4 

ft2 

4.0 

ft2 

Fuel 

60-10=50 

ft2 

0.3 

15.0 

ft2 

Engine 

50-10=40 

ft2 

0.6 

24.0 

ft2 

Overlap 
Area 

10 

ft2 

0.72 

7.2 

ft2 

\ 

= 

50.2 

ft2 

The  net  effect  of  component  overlap  can  be 
a  desirable  reducticc  in  aircraft  vulnerable  area  provided 
the  damage  inflicted  by  the  hit  in  the  overlap  area  does  not 
cause  ether  problems.  For  example,  consider  a  shctline 
through  the  fuel  tank  that  overlaps  the  engine.  Fuel  could 
leak  from  the  punctured  tank  onto  hot  engine  parts,  causing 
a  fire.  In  this  irstance,  the  probability  the  engine  is 
killed  by  the  hit  wculd  probatly  be  higher  than  0.6.  An 
example  of  the  computation  of  aircraft  vulnerable  area, 
assuming  the  possibility  of  ar  engine  fire,  is  given  in 
Table  6.    The  overlapping  area  is  assumed  to  be  10  ft2,  the 

fuel  tack  P ,  ,,  is   assumed  to  be  0.3,   and  the   P,  ,,   for  the 

k/h  '  k/h 
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engine  is  taken  as  O.S  because  an  engine  fire  is  assumed  to 
occur  nearly  always  due  to  a  hit  on  the  overlapping  fuel 
tank.   Then, 

P      =  1  -  [  (1  -  0.3)  X  (1  -  0.9)  ]  (2.27) 

k/h 

'    o 

and   the   aircraft's    vulnerable   area  increases   to   52,3    ft^. 


TABLE  6 

Valnerable  Area  Computation  for  Nonredundant 
Model  With  Overlap  aid  an  Engine  Fire 

Critical  A        i    P,  ,,      =     A 

Ccmpcnent  Pi  '^/'^i  ^i 

Pilot  4  ft2         1.0  4.0  ft2 

Fuel        60-10=50  ft2        0.3         15.0  ft2 

Engine      50-10=40  ft2        0.6        24.0  ft  2 

Cverlap 

Area  10  ft2        0.93        9.3  ft2 

A   =  52.3  ft2 

V 


Comparing  the  aircraft's  vulnerable  areas 
given  in  Tables  Z,  5,  and  6  reveals  that  overlapping  the 
engine  with  the  fuel  tank  reduces  the  vulnerable  area  from 
52  ft2  to  50.2  ft2,  provided  no  fire  can  occur.  If  a  fire 
is  likely  to  occur,  the  vulnerable  area  increases  form  52 
ft2  to  52.3  ft2.  Thus,  overlapping  nonredundant  critical 
components  can  reduce  vulnerability  provided  that  no  undesi- 
rable secondary  kill  nodes  occur. 

Another  facet  of  the  overlap  situation  is 
the  change  in   the  vulnerable  area  of  the   overlap  area  that 
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occurs  when  one  of  the  componerts  along  a  shotline  has  its 
vulneratility  reduced  by  use  cf  a  vulnerability  reduction 
technique.  For  example  suppose  the  Pj^/^  of  the  overlapping 
fuel  tanl^  is  reduced  from  0.3  to  0.0.  The  vulnerable  area 
cf  the  overlap  section,  with  the  possibility  of  a  fire,  is 
reduced  from  7.2  ft2  to  6.0  f t^  .  This  reduction  appears  to 
conflict  with  the  fact  that  10  ft^  with  a  Pk/h  of  0.3,  and  a 
vulnerable  area  of  3.0  ft^,  has  been  made  invulnerable.  The 
reason  for  this  apparent  contradiction  is  the  fact  that  the 
fuel  tank  is  only  one  of  two  overlapping  components. 
Generally,  when  the  vulneratility  of  one  component  is 
reduced,  the  vulnerability  of  another  component  along  the 
shotline  will  become  nore  important.  The  vulnerable  area  of 
each  ccmponent  along  the  shotlice  is  referred  to  as  the  true 
vulnerable  area,  and  the  conponents  contribution  to  the 
overlap  ^julnerable  area  is  referred  to  as  the  incremental 
vulnerable  area.  Using  the  data  of  Table  5,  the  true  vuln- 
erable areas  are  3  ft^  and  6  tt^  for  the  overlapping  fuel 
tank  ard  engine  areas,  and  the  incremental  vulnerable  areas 
of  the  two  overlapping  componeits  are  1.2  ft^  and  4.2  ft^ 
respectively. 

(3)  Aircraft  Mo^€l  Composed  of  Kedundant 
Com  Ticnents  with  No  Overlap.  The  nonredun- 
dant  aircraft  model  described  above  will  now  be  expanded  by 
adding  a  second,  separated  engire,  as  shown  in  Figure  2. 17. 
The  second  engine  is  assumed  to  have  the  same  presented  area 
as  the  first  engine,  50  ft^,  tut  its  P^/^h  is  taken  as  0.7 
because  of  the  presence  of  an  additional  accessory  drive. 
For  the  purpose  of  ccnparison,  the  aircraft's  presented  area 
will  remain  300  f t^  .  The  kill  expression  for  this  model 
aircraft  is: 

Kill  =  (Pilot)   .OE.   (Fuel  Tank)   .OR.  (2.28) 

[  (Engine  1)   .AND.   (Engine  2)   ] 


93 


94 


Table  7  presents  the  values  fcr  the  vulnerability  paraue- 
ters.  The  Equation  fcr  the  prchability  of  aircraft  survival 
given  a  random  hit  on  the  aircraft  is: 


P.,.  =  P..H   ^  ^-"   X  [1  -  {l^,^        X  P^/^   )]     (2.29) 
P 


S/H     s/n^      ^    "^s/H^  ^  L'     ^'k/h^i  ^    Vh^2 


vhich    can   te   rewritter   as: 


Ps/H    =     O    -    Pk/H     )     ^     (1    -    Pk/Hf)     X  (2.30) 

rr 


f  1     -      (fK/H,i       =<    Pk/H,,   )    ] 


TABLE  7 

Eedund 

ant  Aircraft 

Model 

Without  Overlap 

Critical 
Ccmpcnent 

111. 

4  ft2 

X 

Pk/h. 
1.C 

"" 

1 

4   ft2 

Pk/H. 

.0133 

Filet 

lUGl 

60  ft2 

0.3 

18   ft2 

.0600 

Engine  1 

50  ft2 

0.6 

30  ft2 

.  1000 

Ingine  2 

50  ft2 

0.7 

35  ft2 

.  1167 

A   = 

p 

300  ft2 

\ 

=  22 

ft2 

^K/H 

= 

.0733 

Equation  2.30  says  that  the  aircraft   is  killed  if  the  pilot 

is  killed,  or  if  the  fuel  tank  is  killed,  or  if  both  engines 

are  killed.  Carrying  out  the  multiplication   indicated  in 

Equation  2.30  leads  tc: 

Vh      =     ■'     -      '^k/Hp      *    Vhj   )      *      <-VHp       ^     Pk/Hj)      -  (2.31) 


^k/Hf    'J    ^    ^k/Hgi        "    ^k/Hg2 
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If  the  assumption  is  made  that  the  single  hit  cannot  kill 
toth  engines  (recall  the  assumption  that  only  the  cdDpcnent 
hit  can  te  killed) ,  then  all  of  the  component  kills  are 
mutually  exclusive,  and  all  of  the  products  of  the  ccmpcnent 
kill  p  ictatilities  in  Equation  2.31  are  zero.  Hence,  the 
aircraft  is  killed  only  if  the  pilot  or  the  fuel  tank  is 
killed,  and  the  P^  ,„  and  A,,  are: 

K/  n  V 

^  K/H    ^    ^k/Hp     *    \/Hf  (2.32) 

A       =    A         +    A  (2.33) 

P  f 

In  general,  only  these  componerts  whose  loss  or  damage  can 
cause  a  kill  of  the  aircraft  on  a  single  hit  will  contribute 
their  vulnerable  area  to  the  total.  If  the  single  hit  kills 
only  cne  cf  the  redundant  compcnents,  the  aircraft  is  not 
killed,  and  hence,  nothing  is  contributed  to  the  vulnerable 
area.  Thus,  the  tctal  vulnerable  areas  for  this  case  is 
just  the  sum  of  vulnerable  areas  for  each  of  the  nonredun- 
dant  critical  components.  Ccnparing  Table  7  with  Table  3 
shows  the  single  hit  vulnerable  area  reduces  from  52  ft^  to 
22  ft2  due  to  the  addition  of  the  second  engine.  Thus, 
redundancy  can  significantly  reduce  the  vulnerable  area  of 
the  aircraft.  On  the  other  tand,  if  the  damage  to  the 
redundant  component  which  is  hit  creates  secondary  damage 
mechanisms  or  processes  that  propagate  to  another  redundant 
component  and  kills  that  component,  causing  a  less  of  the 
aircraft,  the  redundant  comporents  will  contribute  to  the 
aircraft  vulnerable  areas.  For  example,  suppose  the  prob- 
ability that  a  hit  cc  one  of  the  engines  will  cause  that 
engine  tc  throw  blades  into,  cr  torch,  or  burn  the  other 
engine  is  0.1.  Because  this  can  happen  regardless  of  the 
engine  hit,  the  component  presented  area  becomes  50  +  50,  cr 
100  ft2,  and  the  vulnerable  area  contributed  by  both  engines 
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is  10  ft2.  Thus,  this  failure  mode  increases  the  aircraft 
vulnerable  area  to  32  ft^. 

{^)  Aircraft  ?lod€l  Composed  of  Redundant 
Com^cnents  With  Overlap.  If  redundant 
components  are  now  allowed  to  overlap  one  another,  as  shewn 
ty  the  aircraft  in  Figure  2.18,  the  computation  of  the  vuln- 
erable area  given  by  Equation  2.29  must  be  modified  because 
a  single  hit  in  the  overlap  region  can  kill  both  engines. 

For  this  cas€,  the  cross  hatched  area 
shown  in  Figure  2.18  is  defined  as  the  overlap  area.  A 
single  hit  penetrating  this  area  will  have  a  probability  of 
killing  hoth  redundant  components,  and  hence  the  aircraft. 
!Ihus,  it  will  be  necessary  to  add  the  vulnerable  area  cf  the 
overlap  region  to  that  of  the  ronredundant  critical  compo- 
nents. In  essence,  the  overlap  region  becomes  another  crit- 
ical component,  as  ic  the  nonredundant  model  with  overlap. 
The  vulnerable  area  is  computed  in  the  same  manner  as 
described  previously;  however,  the  details  are  slightly 
different.  The  expression  for  P_/u  given  by  Equation  2.20 
must  be  Eodified.  According  to  Equation  2.20,  the  prob- 
ability that  the  aircraft  survi-ses  a  hit  on  an  overlap  area 
with  Eo  redundant  components  is  given  by: 

P  ,,    =  P    X  P    X  P^   X X  P^  (2.31*) 

s/h^      s^     S2     S3  s^ 

However,  if  there  are  two  recundant  components  amcng  the 
components  along  the  shotline,  such  as  components  number  2 
and  number  3,  the  prctability  that  both  are  killed,  which  is 
assumed  to  cause  an  aircraft  kill,  is  equal  to  the  product 
of  their  irdividual  probabilities  of  kill,  (P  kAi2  ^  ^k/h3  )• 
The  probability  that  both  compoEents  are  not  killed,  which 
is  required   for  aircraft   survival,   is   the  complement   of 

(Pk/h^  ^  Vh   )'  °^  n-(Vh2   ^  Pk/h^)]-     Thus,   (P^^   X  P3^) 

in  Equation  Z.  34  must  be  replaced  with  [1-  (Pk/h?  ^  Pk/h3  )  1 
and    the    result    is   given    by    Equation    2.35. 
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P  ^^    =  F    X  [  1  -  (P      X  F     )  ]  X X  P      (2.35) 


's/h^       s^  k/h2     *k/h3  s 


For  our  example,  the  jrobabilitj  the  aircraft  will  survive  a 
hit  on  the  overlap  region  is  gi\en  by: 

and  the  probability  of  kill  given  a  hit  on  the  overlap 
region  is: 

P,  ,u   =  1  -  [  1-(P      X  P     )  ]  (2.37) 

This  procedure  can  be  extended  to  the  situation  where  there 
are  three  or  more  redundant  overlapping  components  or 
multiple  sets  of  overlapping  redundant  components. 

The  "elsewhere"  or  non-overlapping  areas 
of  each  of  the  redundant  components  are  not  used  in  the 
vulnerable  area  computations  fcr  the  same  reason  as  that 
used  in  the  no  overlap  case.  2  single  shotline  through  any 
one  of  the  redundant  componerts  outside  of  the  overlap 
region  causes  only  a  kill  of  that  component,  net  of  the 
aircraft,   and  hence  no  contribution  is  made  to  the  aircraft 

vulnerable  area.    If  the  P  „   values  for  the  engines  in  the 

k/h 

overlap  region  shown  in  Figure  2.18  are  taken  as  0.6  for  the 
first  engine  hit  and  0.2  for  the  overlapped  engine  (the 
overlapping  engine  slows  the  carnage  mechanism  down) ,  the 
probability  the  aircraft  will  survive  a  hit  on  the  overlap 
region  is  given  by  Equation  2.36  and  is  equal  to  0.88.  The 
probability  of  an  aircraft  kill  given  a  hit  in  the  overlap 
region  is  given  by  Equation  2.3'/  and  is  equal  to  0.12.  If 
the  overlap  area  is  assumed  to  be  10  ft2,  the  vulnerable 
area  increases  to  23.2  ft^  due  to  the  overlapping  engines  as 
shown    by    the   computation    in    Table   8. 
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TABU  8 
Redundant  aircraft  Mcdel  With  Overlap 

Critical       A     x    P,  _     =    A  P,  ,„ 

CcmFcnent       Pj_        ^/^^        ^i  '^/"i 

Eilct         4  ft2        1.0        4.0  ft2      .0133 

Puel        60  ft2        0.3       18.0  ft2      .0600 

Cverlap 

Area        10  ft2        0.12       1.2  ft2      .0040 

A   =  300  ft2      A   =  23.2  ft2      P     =  .0773 

P  V  K/H 


l.   Multiple  Hit  Vulner ability 

The  analysis  will  now  progress  to  the  more 
reasonable  expectation  that  in  any  combat  engagement,  an 
aircraft,  if  hit,  will  recei^je  more  than  one  hit.  The 
distribution  of  these  hits  over  the  aircraft  is  assumed  to 
be  random,  and  all  hits  are  assumed  to  travel  along  shot- 
lines  from  the  same  direction-  This  latter  assumption  is 
not  reguired,  but  is  taken  for  €ase  of  explanation. 

The  probability  the  ith  component  still  survives 
after  n  random  hits  ce  the  aircraft,  denoted  by  p/./h-  '  ^^ 
equal  to  the  product  of  the  comfonent  survival  probabilities 
for  each  of  the  n  hits  on  the  aircraft.  The  superbar  nota- 
tion on  P  indicates  the  joint  probability,  and  the  super- 
script E  in  parentheses  indicates  the  hit  number.   Thus, 

P^(n)    =  Pjl^  X  P^%.  X  ...  X  P<;i.  (2.38) 

i 

where   Ps/h-        ^^    'the    probability      the    ith      component    survives 
the    jth    hit    on    the   aircraft.       The    probability  of    survival   of 
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the  ith  component  due  to  the  jth  hit  on  the  aircraft  is 
equal  to  one  minus  tte  probability  of  kill  of  the  ith  compo- 
nent due  to  the  jth  hit  on  the  aircraft.   Thus, 

Eecall  that  P,  „,   is  assumed  to   be  a  constant  value  for  all 

k/Hi 

j.       Thus,    Equation    2.38    can    be    civen   in    the    form: 

Ps/H       =      n     (1    -    Kjl      )     =    [     1    -    Pk/Hi      1"  (2.40) 

j  =  1       ^  ^ 

The   probability   of  survival   of  the   aircraft 
after  n  hits  can  be  derived  in  a  similar  manner  to  give: 

— (n)        "  (J) 

where  ^■^'l^  is  the  probability  of  kill  of  the  aircraft  due  to 
the  jth  hit  on  the  aircraft,  ard  may  or  may  not  be  constant 
for  all  j.  The  probability  the  aircraft  is  killed  after  n 
hits,  Pj^/H  '  ^^    ^^^  ccnplement  of  Pg,^  ,  or: 


(n)  (n)  n         (-;) 

Vh  =  ^  -  ^s/h  =    '-     n  n  '  ^k/h)  (2.42) 

j=l 

In  any  multiple  hit  assessment,  it  is  necessary 
to  keep  in  mind  the  distinction  between  the  effect  of 
multiple  hits  on  tte  vulnerable  area  of  a  nocredundant 
aircraft  model  as  opposed  to  hits  on  a  redundant  aircraft 
model.  Multiple  hits  on  a  ncrredundant  aircraft  model  do 
not  change  the  total  vulnerable  area  and  the  P^,„  because  of 

K/H 

the  assumption  that  components  are  either  fully  functional 
or  killed.  If  a  shot  hits  the  aircraft,  but  not  a  critical 
component,  the  vulnerable  area  and  the  P y./u  i^^inain  the  same. 
Cnly  when  a  hit  actually  strikes  the  vulnerable  area  of  a 
nonredundant  critical  component  is  the  aircraft  killed. 
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The  redundant  aircraft  model  has  to  be  vieved 
differently.  If  the  redundant  aircraft  takes  the  first  hit 
in  the  vulnerable  area  of  a  redundant  component,  the 
aircraft  is  not  killed,  but  the  aircraft  vulnerable  area  and 
the  P    will  increase  for  the  second  hit  because  one  of  the 

K/H 

redundant  components  has  been  killed.  For  instance,  if  one 
of  two  engines  is  killed  on  the  first  hit,  the  aircraft 
vulnerable  area  is  ucw  increased  by  the  vulnerable  area  of 
the  remaining  engine  because  a  kill  of  the  remaining  engine 
on  a  subsequent  hit  causes  an  aircraft  kill. 

Three  methods  are  presented  below  to  shew  the 
effects  cf  multiple  hits:  The  kill  tree  diagram,  the  state 
transition  matrix  (or  Markov  chain)  method,  and  a  simplified 
approach.  The  first  method  is  more  of  an  instructional 
tocl,  whereas  the  transition  matrix  method  can  be  used  in 
complex  problems  beyond  the  practical  capability  of  the  kill 
tree  diagram.  The  simplified  approach  is  the  easiest  to 
use. 

C)  The  Fill  Tree  Diagram.  The  sequence  cf 
events  explained  above  regarding  the  effects  of  multiple 
hits  can  be  illustrated  diagram natically  using  what  is  known 
as  a  kill  tree  diagram.  The  probability  of  kill  cf  each 
component  given  a  random  hit  on  the  aircraft  is  first 
computed  using  Equation  2.6,  then  the  kill  tree  diagram  is 
created.  To  simplify  the  explanation,  consider  the  nonre- 
dundant  aircraft  model  with  no  overlap  illustrated  in  Figure 
2.15  and  defined  in  Table  3. 

The  Kill  Tree  Diagram,  Nonredundant  Model. 
Figure  2.19  presents  the  kill  tree  diagram  that  defines  the 
mutually  exclusive  kill  probabilities  of  each  nonredundant 
critical  component  (pilot,  fuel,  and  engine),  and  hence  the 
aircraft,  and  the  probability  that  no  critical  components 
are  killed  after  the  first  hit  en  the  aircraft. 
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Figure  2. 19    First  Hit  Bonredundant  Kill  Tree 


^    ^k/Hf  ' 


^   =  Vh,  '   ^^<^  ^ 


In  Figure  2.19,  P  =  P^^^  , 
represents  the  probatility  that  no  critical  components  are 
killed  and  is  given  bj  N  =  1-(P+F+E).  Note  that  P+F+E+N  is 
unity;  all  possibilities  hav€  been  accounted  for  on  this 
first  hit.  The  probability  the  aircraft  is  killed  on  this 
first  hit  is  given  by  P+F+E. 

Figure  2. 20  represents  the  kill  tree 
diagram  after  the  second  hit.  PxP  represents  the  situation 
where  the  first  hit  killed  the  pilot,  and  the  second  hit 
also  killed  the  pilot.  It  is  important  to  note,  however, 
that  once  a  probability  of  kill  is  defined  for  each  critical 
component  on  the  first  hit,  that  component  is  considered 
killed  at  that  probatility  value  for  all  subsequent  hits. 
The  pilot  cannot  be  killed  twice.  The  four  branches  from 
that  kill  probability  for  the  second  hit  adds  nothing  new 
(no  additional  probability  of  pilot  kill)  to  the  sequence. 
This  fact  can  be  verified  by  examining  the  sum  of  the  kill 
probabilities  PxP  PxF  PxE  PxN,  which  is  the  same  as 
Px (P+F+E+N).  Thus,  this  line  is  equal  to  the  protatility 
calculated  for  P  on  the  first  hit  because  P+F+E+N  is  unity. 
The  only  addition  to  the  kill  probability  of  the  aircraft 
due  to  the  second  hit  comes  from  critical  components  not 
killed  on  the  first  hit.  This  concept  will  becone  clearer 
and  mere  important  when  redundart  components  are  discussed. 
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NxP  NxF  NxE  NxN 


IxP  IxF  PxE  PxN 


ExP  ExF  ExE  ExN 


Figure  2.20    Second  Hit  lonredundant  Kill  Tree 

In  crder  to  illustrate  the  develcpment  of 
a  kill  tree  diagram,  assume  the  numerical  values  for  the 
component  kill  probabilities  gi-ven  in  Table  3.  Figure  2.21 
illustrates    the  kill    tree   for    the    first   hit.    The 


0.0133 
KILL 

F= 

C.0600 

KILL 

0.0100 
KILL 

N  = 
0.8267 

Figure  2.21    First  Hit  Bonredundant  Kill  Tree  Example 

probability  the  aircraft  is  killed  after  the  first  hit  is 
the  sum  cf  the  kill  probabilities  for  each  of  the  critical 
components.   Thus, 


-(1) 
P 

K/H 


=    .0133    +    .060C    +    .1000    =    0.1733 


(2.43) 


loa 


and    h€ncG, 


-d) 


-    0.1733    =    0.8267 


(2.44) 


Figure  2.22  extends  this  example  to  the 
second  hit.  The  prcbability  the  aircraft  is  killed  after 
the  second  hit  is  the  sum  of  the  additional  kill  probatili- 
ties  for  each  of  the  critical  ccmponents  for  the  second  hit. 
Thus, 

Pwi     =    k]^     *    [0.8267    X    (.0132    +    .0600    +    .1000)  ]       (2.45) 

K/  H  K/ n 


and    hence, 

-(2) 


S/H 


=     1     - 


_(2) 

^K/H 


=     1   -    .3166    =    .6834 


(2.46) 
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N 
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KILL 

X     /    V 
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KxF 

NxE 

NxN 

01C99 

.04S60 

.08267 

.68343 

Kill 

Kill 

KILL 

Figure   2.22        Second   Hit   Honredundant   Kill  Tree    Example 

The      kill    tree      diagram      procedure    may      be 
continued    indefinitely   to      determine   Ps/h    ^°^   ^^^      numter   of 


105 


hits.  Hovever,  the  probability  the  nonredundant  aircraft 
model  survives  a  sequence  of  hits  can  also  be  computed  using 
Iguation  2.41.  For  the  nonredurdant  aircraft  model,  Pwh  ^^ 
constant  as  explained  above.  Thus,  the  probability  the 
aircraft  survives  two  hits  is  given  by: 

-  (2)  (1)  (2) 

Ps/H    =    n    -   Pk/h)    X    (1    -   Pk/h)    =    (1    -   Pk/h)^  (2.47) 

or, 

-  (2) 

Ps/H    =    O    -    0.1733)2    =    0,6834  (2.48) 

!3ote  that  this  value  is  the  sane  as  that  obtained  frcn  the 
kill  tree  diagram,  as  it  should  be. 

Equation  2-4  1  can  be  used  for  any  number 
of  hits  and  is  much  easier  to  use  than  the  kill  tree 
diagram.  The  essence  of  this  equation  is  that  all  of  the 
nonredundant  critical  components  can  be  combined  into  one 
composite  critical  component  whose  vulnerable  area  is  52  ft^ 
and  whose  Pw^  is  0.  1733  in  the  numerical  example, 

Kill  ^ree  Eiaaram,  Redundant  Model. 
Consider  new  the  redundant  aircraft  model  shown  in  Figure 
2.17  and  defined  in  Table  7.  An  evaluation  for  Fj,,^^  and 
^s/H  ^^^  ^®  performed  in  a  marner  similar  to  the  previous 
discussion.  Although  the  engines  are  redundant  critical 
components,  each  must  be  shown  as  a  separate  branch  in  the 
kill  tree  diagram,  because  a  kill  of  an  engine  is  a  possible 
outcome  of  an  aircraft  hit;  and  any  engine  kill  will  have  an 
effect  on  the  aircraft's  vulnerability.  Figure  2.23  illus- 
trates the  kill  tree  diagram  fci  the  first  hit.  Note  that  N 
now  represents  the  probability  that  no  nonredundant  or 
redundant  component  is  killed. 

The  logical  kill  expression  for  this 
redundant  aircraft  model  is  given  by  Equation  2.49. 
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E  = 
.0133 
KILL 

F= 
.0600 
KILL 

E1  = 
.  100C 

E2= 
.1167 
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.7100 

Figure  2.23    First  Hit  Redandant  Kill  Tree  Example 


(Pilot)   .OR.   (Fuel  Tank)   .OR 
[  (Engine  1)  .AND.  (Engine  2)  ] 


(2.^9) 


Because  the  first  hit  cannot  kill  both  engines,  the  prob- 
ability that  the  aircraft  is  killed  after  the  first  hit  is 
just  the  sum  of  the  kill  prcbabilities  for  each  of  the 
nonredundant  critical  components  (pilot  and  fuel).   Thus, 


"^K/H  "  0.0133  +  0.0600  =  0.0733 


(2.50) 


Figure  2.24  illustrates  the  event  prob- 
abilities on  the  second  hit  after  a  kill  of  engine  1  on  the 
first  hit.  The  sequence  represented  by  killing  engine  1  on 
the  first  hit  and  then  killing  the  pilot  (0.00133),  or  fuel 
(0.06C0),  or  engine  2  (0.01167)  on  the  second  hit  results  in 
additional  aircraft  iills.  Thus,  the  cumulative  probability 
of  an  aircraft  kill  is  due  tc  kills  of  the  nonredundant 
critical  components  as  well  as  kills  defined  by  component 
redundancy  restrictions.  The  five  branches  from  a  kill  of 
engine  2  and  from  the  N  branch  will  also  contribute  addi- 
tional kills.  Thus,  after  twc  hits,  the  cumulative  prob- 
ability of  kill  is  given  by  Equation  2.51. 
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p= 

C133 
KILL 


.0600 
KILL 


E1  = 
.10CC 


EixE 
.0013 
KILL 

ElxF 

.0060 

KILL 

EixE  1 
.0100 

ElxE2 

.01167 

KILL 

ElxN 
.0710 

Pigure  2.2U    Second  Hit  After  First  Hit  on  Engine  1 


-(2) 
P 

K/H 


=  .0733  +  [.10C0  X  (.0132  +  .0600  +  .1167)]   (2.51) 


+  [.1167  X  (.0133  4  .0600  +  .1000)] 
+  [.7100  X  (.0133  +  .0600)]  =  0.1646 

and  hence: 


p<2) 

S/H 


=  1  -  0. 1646  =  0.8354 


(2.52) 


Note  the  significant  increase  in  survivability  (0.8354 
versus  0.6834)  after  the  second  hit  due  to  the  addition  of 
the  second  engine. 

This  procedure  can  be  continued  irdefi- 
nitely,  as  in  the  nonredundant  case,  but  it  is  obvious  that 
the  ccmputations  quickly  become  overwhelming  in  complexity. 
The  state  transition  matrix  method  described  below  is  better 
suited  to  handle  the  problem. 
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(2)  The  State  Transition  Matrix  ilethgd  (Markov 
Chaic) .  Briefly,  the  state  transition 
matrix  method  assumes  that  a  sequence  of  independent  events 
(random  hits  on  the  aircraft)  can  be  modelled  as  a  Markov 
process.  In  a  Markov  process,  the  aircraft  is  defined  to 
have  two  or  more  states  in  which  it  may  reside,  and  the 
probability  of  an  aircraft  kill  due  to  the  j+1  hit  is  the 
probability  that  the  j+1  hit  or  the  aircraft  will  cause  the 
aircraft  to  transiticr  from  a  ncn-kill  state  after  j  hits  to 
a  kill  state.  The  sequential  process  of  evaluating  the 
probability  the  aircraft  exists  in  each  of  the  several 
possible  states  after  hits  1,  2,  3,  ...,  J  is  based  upon  the 
probability  the  aircraft  existed  in  each  of  the  possible 
states  after  hits  0,  1,  2,  ...,  J-l/  respectively,  and  is 
referred  tc  as  a  Markov  chain.  Rather  than  dwell  on  the 
mathenatical  theory,  an  example  using  the  previously  defined 
redundant  aircraft  model  will  serve  much  better  tc  illus- 
trate the  methodology. 

An  aircraft  consisting  of  a  pilot,   a  fuel 
tank,  and  two  engines  can  exist  in  five  distinct  states: 

1.  One  or  more  of  the  nonredundant  critical  components 

(the  pilot  and  the  fuel  tark)  have  been  killed, 
resulting  in  an  aircraft  kill,  denoted  by  Knrc. 

2.  Cnly  engine  1  has  been  killed,  denoted  by  Krcl. 

3.  Cnly  engine  2  has  been  killed,  denoted  by  Krc2. 

4.  Both  engine  1  and  engine  2  have  been  killed, 
resulting  in  an  aircraft  kill,  denoted  by  Krc. 

5.  None  of  the  nonredundant  critical  components  and 
neither  of  the  engines  are  killed,  denoted  by  NK. 

States  Knrc  and  Krc  are  called  absorbing  states  because  the 
aircraft  cannot  transition  from  these  two  kill  states  tc  any 
of  the  ether  three  non-kill  states. 
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A  transition  iratrix  of  probabilities,  [I], 
can  now  be  constructed  to  specify  how  the  aircraft  will 
transition  from  one  state  to  aEother  due  to  a  hit  ce  the 
aircraft.  Table  9  illustrates  the  computation  of  the  [T] 
matrix  for  the  example  redundaEt  aircraft  model  defined  in 
Table  7.    Each    element   of   the   matrix    represents   the 


TABLE  9 

Compatation  of 

the  State  Transiti 

on  Matrix 

Probability  of 
this  state 

transitioning  from 

Knrc     Krcl 

Krc2      Krc 

NK 

to  this 
state 

300      4+18 

4+18        0 

4+18 

Knrc 

1 

0      30+213 

0        0 

30 

Krcl 

30C 

0        0 

35+213      0 

35 

Krc2 

0       35 

30       300 

0 

Krc 

1  0        0 

0        0 

of  each  column  is 

213 
unity 

NK 

No 

te  that  the  sum 

probability  of  transitioning  from  the  state  defined  by  the 
column  locations  to  the  new  state  defined  by  the  rcw  loca- 
tion. Ihe  matrix  is  read  as  follows.  The  probability  of 
the  aircraft  transitioning  frcn  the  Knrc  state  to  the  Knrc 
state  is  unity  (300/300)  because  Knrc  is  an  absorbing  state. 
The  probability  of  transitioni rg  from  the  Krcl  state  (kill 
of  engine  1)  to  the  Knrc  state  (kill  of  a  nonreduEdant 
component)  is  the  sum  of  the  conditional  probabilities  of 
kill  cf  the  two  nonredundant  conponents,  that  is,  P+F.  The 
probability  of  transitioning  frcm  Krcl  to  Krcl  (remaining  in 
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Krc1)  is  the  sum  of  engine  Vs  probability  of  kill  given  a 
hit  on  the  aircraft.  El,  and  that  of  the  remaining  "else- 
where" area  of  the  aircraft,  N.  Transitioning  froir  Krcl  to 
Krc2  is  zero  because  a  kill  of  the  second  engine  after  the 
first  engine  is  killed  defines  the  state  Krc.  Thus,  the 
state  transitions  frcn  Krcl  to  Krc  according  to  the  condi- 
tional probability  of  kill  of  the  second  engine,  E2,  and  so 
on. 

Let  the  prchability  that  the  aircraft 
exists  in  each  of  the  five  possible  states  after  the  jth  hit 
be  expressed  by  a  vector  [S]  -^  ,  where 


[S] 


(J) 


Knrc 

Krcl 

Krc  2 

Krc 

NK 

l^ote  that  the  sum  of  the  elements  in  [  S  ]  -"  is  always  unity; 
the  aircraft  must  exist  in  one  of  these  five  states.  The 
probability  the  aircraft  is  in  each  one  of  the  five  states 
after  the  (j+1) th  hit  is  given  ty: 


(j+l)  (j) 

[S]       =  [T]  [S]  ^ 


(2.53) 


That  is,   the  aircraft  transitions  from  [S]  -"   to[S]  -'^ 
according  to  [T]. 

An  aircraft  kill  is  defined  by  those 
states  that  specify  either  a  kill  of  any  of  the  nonredundant 
components  or  a  kill  of  enough  members  of  the  sets  of  redun- 
dant components,  such  as  both  engines.  In  this  example, 
Knrc  and  Krc  specify  the  kill  states.  Hence,  the  prob- 
ability the  aircraft  is  killed  after  n  hits  is  given  by: 


•r  (n)    „      n 
P  ,   =  Knrc 

K/H 


+  Krc 


(n) 


(2.54) 
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(n) 


(n) 


where    Knrc  and   Krc  are      the    probabilities    the    aircraft 

is   in    these    two    states    after    n    hits. 

Using  the  lumbers  generated  in  the 
previcijs  numerical  example,  consider  the  first  hit.  Prior 
to  the  first  hit,  the  aircraft  is  entirely  in  the  NK  state. 
Thus,    according    to   Equation    2.5  3: 

C 


CS] 


(1) 


=    [T] [S] 


(0) 


=    [T] 


NK 


Carrying   out   the    matrix   multiplication   gives: 


(1) 


[S] 


hit: 


0.0773  Knrc 

0.1000 

0.1167 

0  Krc 

_0 . 7 1 0  0_ 
=    0. 0733    as   before 


Similarly,      for    the    second 


[S] 


(2). 


=    [T]    [S] 


(1) 


0.0733 
C.1000 
=    [T]         0.1167 
0 
_0,710  0_ 
Carrying   cut   the   matrix   multiplication    gives: 


[S] 


(2) 


0.1413 
0.1520 
0.1793 
0.0233 
0.5401 


Knrc 


Krc 


Note  that  the   sum  of  the  elemerts   of  [S]  is  unity,    as  it 

12) 

should    be.         The   [ S J  vector    results   reveal   that    after   the 

second    hit    there    is    a      14.13    percent   probability    that    either 
the    pilot    or  the   fuel  tank    or    bcth    have    been    killed,    a    15.20 
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percent  protability  that  engine  1  has  been  killed,  a  17.93 
percent  probability  that  engin€  2  has  been  killed,  and  a 
50.4  1  percent  probability  that  none  of  the  critical  compo- 
nents have  been  killed.   Thus,  after  the  second  hit: 

P^^^  =  0.1413  +  0.C233  =  0.1646  (2.55) 

K/H 

This  value  is  the  sane  as  that  obtained  from  the  kill  tree 
diagram  after  the  second  hit,  as  it  should  be.  This  process 
can  easily  be  continued  for  as  nany  hits  as  desired.  Figure 
2.25  shows  the  P},'        as  a  function  of  n  for   both  the  redun- 

K/n 

dant  aircraft  model  and  the  nonredundant  aircraft  itodel 
given  in  Table  3.  The  differerce  between  the  two  curves  is 
the  reduction  in  vulnerability  due  to  redundancy. 

In  the  above  presentation,  the  transition 
matrix  was  assumed  to  be  the  same  for  all  hits.  This 
assumption  is  not  necessary.  If  multiple  damage  mechanisms 
hit  the  aircraft  frcir  several  different  aspects,  a  tran- 
sition matrix  can  te  constructed  for  each  aspect  of 
interest.  The  computation  of  the  state  vector  for  the  j+1 
hit,  given  by  Eguaticn  2.53,  would  use  the  transition  matrix 
for  the  approach  direction  of  that  particular  hit.  Another 
possible  modification  is  the  ccrsideration  of  an  increase  in 
P      due  to   multiple  hits.    Again,   [T]   could  be  changed 

K/Hi 

from  one  hit  to  the  next. 

(3)  A  Siirplified  Ax£roach.  If  the  probability 
of  survival  of  each  of  the  critical  components  after  n  hits 
on  the  aircraft  is  known,  an  approximation  for  the  prob- 
ability the  aircraft  has  been  killed  by  the  n  hits  can  be 
obtained  by  neglecting  the  mutually  exclusive  feature  of  the 
individual  component  kills  on  acy  one  hit.  Thus,  for  the 
example  redundant  ccmponent  aircraft  model,  Eguaticn  2.30 
can  be  used.  Eguaticn  2.30,  for  the  n  hit  situation,  is 
given  by  Eguation  2- 56. 
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-  (n)       -(n)      -(n)       -(n)     -  (n)  ^  ^, 

P  ,      -  (1-P  ^   )  (1-P     )(1-(P      )  (P      ))  (2.56) 

S/H        k/Hp      k/H^       k/H^^    k/H^2 

where 


and 


(p(n).   )(p(n)-   )  =  a-u-p     )n)(i_(i_p     )nj  (2.58) 

according  to  Equation  2.U0.  Table  10  presents  the  Pj^/h  f°^ 
toth  the  transitioE  matrix  method  and  the  simplified 
approach  for  several  values  of  e.  Note  that  the  approximate 
^K/H  -^^  toth  lower  than  and  hicher  than  the  correct  answer 
and  that  the  approximate  kill  probability  is  reasonably 
close  to  the  correct  value,  for  this  example. 


H 

its. 

n 

P 

(nL 

K/H 

C 

crrec 

t 

P 

(nL 

TABLE  10 
A  Comparison  of  Aircraft  Kill  Probabilities 

1       3       5        10       20 
.0733    .2615    .4456    .7619    .9640 


K/H  .0833    .2693    .4436    .7470    .9567     J 

Approximate 


] 


(4)  Multiple  Hit  Vulnerable  Area.  The  cumula- 
tive probability  of  kill  given  n  hits  derived  above  is  not 
necessarily   the  best   measure   for   assessing  or   comparing 
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aircraft  designs  due  to  its  dependence  on  the  physical  size 
of  the  aircraft.  If  two  aircraft  have  identical  vulnerable 
areas,  hut  different  presented  areas,  the  one  with  the 
largest  presented  area  will  afpear  to  be  less  vulnerable 
because  its  cumulative  probability  of  kill  given  n  hits  will 
be  less  than  that  of  the  aircraft  with  the  smaller  presented 
area-  Cn  the  other  hand,  being  larger,  it  may  suffer  more 
hits;  that  is,  it  may  be  more  susceptible. 

The  measure  that  is  the  most  ireaningful 
for  vulnerability  assessment  and  comparison  of  designs  is 
vulnerable  area.  For  nonredundant  aircraft,  the  probability 
cf  kill  given  a  hit  and  the  vulnerable  area  are  constant  for 
each  and  every  hit.  Each  subsequent  hit  has  just  as  much 
chance  of  killing  the  aircraft  as  the  previous  hit  (assuming 
component  degradation  is  neglected).  However,  this  is  not 
true  for  aircraft  with  redundant  critical  components.  For 
these  aircraft,  the  frobabilitj  of  kill  given  a  hit  and  the 
corresponding  vulnerable  area  changes  with  each  hit  because 
of  the  increasing  possibility  of  the  loss  of  one  or  mere  of 
the  redundant  components.  In  crder  to  compute  the  multiple 
hit  vulnerable  area,  an  event-based  probability  cf  kill 
given  a  hit  must  be  computed  for  each  hit.  In  general,  the 
probability  of  aircraft  survival  after  taking  n  hits  was 
given  by  Equation  2.41  which  is: 

which  also  can  be  expressed  in  the  form: 

-(n)         (^(n-l)       (i_-(n)  (2.60) 

""   f  n  ^ 

The  value  desired  in  Equation  2.60  is  Pj^/jj  ,  the  event-based 
probability  that  the  aircraft  is  killed  on  the  nth  hit  on 
the  aircraft  given  that  it  has  survived  the  first  (n-l) 
hits.      Eearranging    terms    in    Equation    2.60    gives: 
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(n)  -(n)  -(n-1)  ^     ,. 

Equation   2.61    can   alsc    be    given    in    the   form: 

(n)  —  (n)  —(n-1)  .^     coa 

1   _    p'    '    =    (1   -   p'      )    /     .1   -   P  )  (2.  62) 

K/H  K/H  K/H 

and    hence, 

p(")    =    (p(")    -  p(>^-^^    /    (1  -  5^"-^)-  (2.63) 

K/H  K/H  K/H  K/H 

Ihe  vulnerable  area  fcr  the  nth  hit.  Ay  ,  is  computed  using 
the  Pj,/pj  given  by  Equation  2.63  and  the  basic  vulnerable 
area    equation.    Equation    2.1.       Tlus, 

A^"^    =    (A  )    (P^^^  (2.64) 

V  P  K/H 

(n) 
Figure  2.26  shows  the   A.,    for  the  redun- 
_(n)  ^  (1) 

dant  model  Pk/h  given  m  Figure  2.25.   Note  that  the  Ay    is 

just  the  sum  of  the  vulnerabl€  areas  of  the  nonredundant 
components.  Note  also  the  asymptotic  behavior  for  the 
redundant  model.  The  constant  vulnerable  area  of  the  nonre- 
dundant aircraft  given  in  Table  3  is  also  plotted  in  Figure 
2.26  fcr  the  purpose  cf  comparison.  Note  that  the  vulner- 
able area  of  the  redundant  aircraft  is  less  than  that  of  the 
nonredundant  aircraft  (with  the  30  ft^  vulnerable  area 
engine)  for  the  first  fifteen  hits.  On  subsequent  hits,  the 
vulnerable  area  is  slightly  larger  due  to  the  fact  that 
there  is  a  strong  likelihood  that  one  or  the  other  of  the 
two  engines  has  been  >:illed,  atd  the  benefits  of  redundancy 
have  been  eliminated. 

c.   Presentation  of  Results 

Nonexplcsive  projectile  results  normally  will  be 
presented   in   summary  forms   cf   total  A    of   nonredundant 
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compoEents  for  each  combinatior  of  threat,  kill  category, 
and  striking  aspect  assessed  with  the  striking  velocity 
varying  from  500  to  3500  ft/sec.  Manual  assessments  for 
nonexplcsive  projectiles  will  te  performed  for  at  least  the 
six  majcr  views  of  tie  aircraft.  A  computerized  assessment 
will  be  performed  fcr  at  least  the  six  major  views  and 
usually  for  a  total  of  26  views  spread  at  45  degree  incre- 
ments of  elevation  and  azimuth  as  described  earlier.  A 
typical  total  aircraft  single  hit  vulnerable  area  summary 
form  is  shown  in  Figure  2.27.  Multiple  hit  vulnerable  area 
cur.ves  similar  to  tie  one  showr  in  Figure  2.26  should  also 
be  presented  for  at  least  six  aspects. 

In  addition  to  the  total  aircraft  A^  presenta- 
tion, the  vulnerable  area  of  each  critical  component  should 
also  be  listed,  and  both  the  true  and  the  incremental  vuln- 
erable areas  should  be  presented  for  overlapping  components. 
Redundant  components  should  be  identified,  and  the  number  of 
redundant  components  that  must  be  killed  to  cause  an 
aircraft  kill  should  be  noted.  The  single  hit  vulnerable 
area  asscciated  viith  overlapping  redundant  components  should 
also  be  identified.  Figure  2.28  shows  a  sample  component 
vulnerable  area  summary  form. 

For  explosive  projectiles  and  contact  fuzed 
missiles,  vulnerability  data  normally  will  be  presented  as 
summary  forms  of  the  total  A^  of  nonredundant  components  for 
each  combination  of  threat,  kill  category,  and  aspect  angle 
assessed.  These  results  usually  are  not  presented  as 
varying  with  the  fragment  striking  velocity.  Each  major 
redundant  component  will  be  shown  separately  if  assessed. 
Assessments  will  be  performed  for  at  least  the  six  major 
views  and  for  26  views  if  possihle.  For  HE  projectiles,  in 
addition  to  the  total  aircraft  vulnerable  area,  the  contri- 
bution ty  subsystem  or  aircraft  region  should  also  be 
presented.    This   can  be  done   similar  to   the  nonexplcsive 
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L— -^^^"""^^ 

^ — V 

Wing                           ^       ' 

8le«d  air  systwi_^ ^^"^ 

Figure  2.28    Sanple  Component  Vulnerable  Area  Fori 

projectile,  or  in  a  sketch  of  the  aircraft  with  regions 
shown  and  the  region's  presented  area  and  vulnerable  area 
summarized  on  an  acccirpanying  fcrm. 

2 .  Blast 

Aircraft  vulnerability  to  external  blast  is  usually 
expressed  as  an  envelope  about  the  aircraft  where  the  deto- 
nation   of      a   specified      charge    weight      of    spherical      uncased 
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pentolite  high  explosive  will  r€sult  in  a  specified  level  of 
damage  or  kill  to  the  aircraft.  Detonation  outside  of  such 
an  envelope  will  result  in  little  or  no  damage  to  the 
aircraft  or  in  a  lesser  kill  le-vel.  The  damage  mechanism  is 
the  hlast  resulting  from  the  detonation  of  the  high  explo- 
sive in  the  vicinity  of  the  aircraft.  A  spectrum  of  charge 
weights  are  often  specified  for  which  the  aircraft  vulner- 
ability measures  are  computed  in  the  vulnerability  assess- 
ment. The  specific  charge  weights  selected  are 
representative  of  the  expected  threat  warheads  which  might 
he  encountered.  Envelopes  are  determined  for  a  variety  of 
encounter  conditions  which  account  for  variations  in 
aircraft  speed  and  altitude,  as  well  as  aspect.  Aircraft 
critical  components  -vulnerable  to  the  external  blast  consist 
principally  of  portions  of  the  airframe  structure  and 
control  surfaces.  Threshold  kill  criteria  for  the  critical 
components  are  derived  from  structural  and  aerodynamic  anal- 
yses, Cnce  the  blast  pressures  and  impulse  levels  required 
for  a  conpcnent  kill  are  determined  for  several  locations  on 
the  aircraft  surface,  a  contour  may  be  plotted  corresponding 
to  the  detonation  distance  and  the  weight  of  pentolite  which 
will  picvide  the  required  overpressure  and  impulse  level. 
Two  different  graphical  presentations  of  the  data  may  be 
used.  The  first  is  a  plot  of  charge  weight  versus  distance 
for  a  constant  kill  level.  Several  curves  can  be  drawn  on 
the  same  graph,  one  for  each  altitude  of  interest.  A 
similar  graph  is  required  at  each  azimuth  and  elevation 
angle  of  interest  abcut  the  aircraft.  Figure  2.29  is  an 
example  of  this  type  cf  presentation.  The  second  graphical 
method,  illustrated  in  Figure  2.30,  is  to  construct  iso- 
charge  weight  contours  about  the  aircraft  for  a  given  kill 
level  and  altitude  in  all  planes  of  interest. 
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Figure  2.29    Typical  External  Blast 
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3-   iB^Same  Anal^^sis 

The  probability  of  an  aircraft  kill  due  to  the  burst 
of  a  specific  warhead  for  a  particular  set  of  encounter 
conditions,  ^k/d  '  ^^  dependent  upon  how  many  fragments  hit 
the  aircraft  and  the  aircraft's  vulnerability  to  the 
multiple  hits.  The  number  of  fragments  which  strike  the 
aircraft  was  derived  in  the  previous  chapter  and  the 
aircraft's  vulnerability  to  multiple  hits  was  discussed  in 
the  previous  section.  The  Pj^/p,  due  to  the  n  hits  on  the 
aircraft  is  analogous  to  the  Pk//i  derived  in  this  chapter 
earlier.     Thus,   ^k/d   ^^^  ^^   estimated  using   cumulative 
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150  LB  (68 1  KG) 
100  LB  (45.4  KG) 
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150  LB  (68.1  KG 
100  LB  (45.4  KG) 
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20LB(  9.1  KG) 


Figure  2.30    Typical  Externa]  Blast  K-Kill  Contour  for 
Various  Heights  cf  Uncased  Pentolite  at  Sea  Level 


probatility   of  kill   curves   similar  to   the   one  shown   in 


Figure  2.25.    Simplified  equations  for  P 


K/D 


in  terms  of  the 


aircraft  vulnerable  area  and  the  n  hits  are  derived  below. 

The  probability  the  aircraft  is  killed  given  the  jth 

-(n) 


random  hit  by   a  single  fragment,   P 


K/H  / 


can  be  determined 


using  the  procedure   described  in  this  chapter. 


The  prob- 


ability that  the  aircraft  is 
random  hits  from  detonation, 
2.42.   Therefore, 


killed  by  the   n  independent, 
is  given   by  Equation 


p(n) 
K/H  ' 


P^"^  =  P     =  1   - 
K/H     K/D 


"         (j) 


(2.65) 
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It    can    he    shown    that    for    small    V .],,  , 

is/  H 

"  (j)  "(j) 

^    ^^    "    ^K/H^        =      ^""P^'^^K/H^  (2.66) 

j=l  j=l 

f urthermcre^ 

n     (j)  ^     (j) 

E    P^;^  =       ^    V     /  Ap  (2.67) 

j=l  j=l 

Hence,  P^^,^  can  be  given  in  the  form: 

n 
P^^^   =    I    -   expl   (^    p  /   n)        I       A^^S  (2.68) 

j  =  l 

according  to  Equation  1.33.  If  there  are  no  redundant  crit- 
ical ccmponents.  Ay  is  usually  assumed  to  be  a  constant 
value  for  all  hits,  and  Pj^/n  sinplifies  to: 

P    =  1  -  exp(-  p  A  )  (2.  69) 

K/D  V 

An  example   of  the  coaputation  cf   P    for  an   encounter  is 

^  ^  K/D 

given  in  Table  1 1 . 

Ihere   is  no   unique  value   for  Pk/d   ^"^^  ^  warhead 

detonation   at   a   specific  location   with   respect  to   the 

aircraft.    P  ,    will  be  different   for  detonations  at  the 

K/D 

same  distance,  but  at  different  locations  around  the 
aircraft.  Nevertheless,  the  aircraft's  vulnerability  to  an 
externally  detonating  warhead  is  often  indicated  only  with 
respect  to  the  distance  of  the  detonation  from  the  aircraft, 
vithcut  regard  to  the  ether  variables. 

fi      typical  curve  relating   P  ,    to  the   detonation 

■^  ^  ^  K/D 

distance,  R,  is  given  in  Figure  2.31.  This  curve  is 
referred  to  as  the  kill  functicE  given  a  detonation,  and  the 
radius  at  which  Pj^,j^  is  equal  to  0.5  is  called  the  lethal 
radius  of  the  warhead.  The  value  of  Pj^/^^  specified  for  each 
value  of  E   could  be  the  average  of  the   Pk/d  '^  computed  for 
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TABLE  11 
An  Example  Comp ctation  for  P 

^         '^  K/D 

Static  Warhead    Spray  angles,  a^  =  50,  cl^   =    120 
Parameters 

liumber  of  fragments,  N  =  1000 

fragment  velocity,  V-^  =  7000  fps 

Encounter        Ifissile  speed,  V   =  1500  fps 
Parameters 

tissile  ancle,  0  =  30 

Detonation  distance,  E  =  80  ft 

Aircraft  speed,  Vt  =  1000  fps 

Aircraft  Jiircraft  presented  length  =  50  ft 

Parameters 

JSspect  vulnerable  area,  A^  =  25  ft^ 

(to  fragment  size  and  striking 
velocity  nnder  consideration) 

Fragmentation     '^-,    =  Tan--i[764U  /  1515]  -  30 

Dynamic  Spray 

Angles  <^2    =  Tan-i[4250  /  -5763]  -  30 

Eragment  P  =  1000  /  [2  x    x  8O2  x  1.059] 

Spray  Density 

P  =  .0235  fragments/f t2 

Probability       Pi./^  =  1  -  exp  (-0.0235  x  25) 
of  kill    ^        K/D 


several  different  encounters  at  R,  or  the  Pwd  values  could 
be  weighted  with  respect  to  the  expected  probability  of 
encounter  occurrence  in  order  tc  obtain  a  weighted  average. 
For  example,  if  a  certain  nissile  only  approaches  the 
aircraft  from  the  rear  aspect,  only  Pk/d  values  for  that 
type  of  encounter  would  be  computed. 
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I.   7D1NEEABILITY  TO  IBTERNALIY  DETONATING  HE  WAEHEAES 

Anti-aircraft  projectiles  2Cmm  and  larger  often  have  an 
HE  core  with  a  contact  fuze  that  detonates  the  warhead 
either  immediately  or  shortly  after  impacting  the  aircraft. 
This  results  in  a  detonation  on  or  inside  the  aircraft,  with 
the  acccmpanying  blast  and  fragment  spray  in  many  direc- 
tions. The  assumption  of  parallel  trajectories  or  shotlines 
through  the  aircraft  used  in  the  nonexplosive  penetrator 
vulnerability  assessment  is  not  valid  in  this  situation. 
Instead,  the  fragment  shotlines  emanate  radially  from  the 
location  of  the  warhead  burst  point.  The  probability  of 
kill  of  any  critical  componen-ts  that  lie  on  any  of  the 
radial  fragment  shotlines  needs  to  be  evaluated  and  the 
aircraft's  vulnerable  area  and  probability  of  aircraft  kill 
given  a  hit  computed. 

There  are  several  approaches  to  this  problem.  Cne 
simple  approach  is  to  expand  the  presented  area  of  each  of 
the  critical  components  beyond  the  actual  physical  size  of 
the  component,  and  then  treat  a  hit  by  the  HE  round  in  the 
expanded  area  in  the  same  manner  as  that  used  for  the 
nonexplosive  penetrator.  For  example,  the  presented  area  of 
the  pilot  could  be  tie  entire  cockpit,  because  any  hit  and 
detonation  within  the  cockpit  could  kill  the  pilot.  Figure 
2.32  illustrates  this  approach.  If  the  expanded  areas  of 
two  or  more  components  intersect  or  overlap,  the  procedure 
for  accounting  for  overlapping  components  described  above 
must  be  used. 

In  another  procedure,  the  ^(arhead  detonation  is  assumed 
to  take  place  at  individual  locations  within  a  grid  superim- 
posed on  the  presented  area  of  the  aircraft,  as  illustrated 
in  Figure  2.33.  Each  cell  contains  one  randomly  located 
burst  point.  The  probability  of  killing  the  aircraft  is 
then  evaluated  for  each  burst  point.    This  kill  probability 
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will  t€  dependent  upcn  the  relative  location  of  the  adjacent 
critical  components  and  on  any  shielding  of  these  components 
provided  fcy  intervening  structure  and  non-critical  compo- 
nents. Critical  ccmponents,  or  parts  of  critical  compo- 
nents, outside  of  the  cell  in  which  the  burst  occurs  must 
also  te  considered  when  they  can  be  hit  and  killed  by  the 
damage  mechanisms.  Note  that  several  redundant  critical 
components  can  possibly  be  killed  by  the  single  HE  burst. 
The  burst  point  kill  probability  is  determined  using  the 
kill  expression  for  the  aircraft.  However,  because  mere 
than  one  critical  ccnponent  can  be  killed  given  a  single 
burst,  the  individual  component  kills  are  not  exclusive;  a 
single  burst  could  kill  both  the  fuel  system  and  the  pilot. 
Thus,  the  approach  used  in  the  overlapping  component  Eodel 
to  compute  V.,-.  must  also  be  used  here.  The  probability  of 
an  aircraft  kill  given  a  randcn  hit  from  the  attack  aspect 
under  consideration  is  obtained  by  multiplying  the  prob- 
ability of  aircraft  kill  given  a  hit  computed  for  each  burst 
point,  i'T^/TT  ,  by  the  probability  of  a  random  shot  hittirg 
the  burst  point  area,  P^  .  The  latter  probability  is  given 
by: 

Ph  =    A^  /  a      ,  t  =  1,  2,  .,.,  B  (2.70) 

b         P 

where  E  is  the  number  of  burst  points  or  cells  considered, 
and  A  is  the  local  grid  cell  area  around  each  burst  point. 
Note  that  even  though  critical  components  outside  of  the 
cell  are  included  in  ^^/n  ,  just  the  area  of  the  cell  itself 
is  used  in  the  computation-   The  P^  ,„  for  the  aircraft  given 

K/  H 

a   random    hit    is    giver   by: 

B  B 

p^^^,  =    r    (P    )  (P       )  =  A       r    (A  )  (p  ^    )  (2.71) 

K/H  H^^         K/H^^  P  b         K/Hj^  ' 

b=l  b=l 

where  A    is  the  vulnerable  area  of  the  bth  cell. 

^b 
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The  aircraft  vulnerable  area  is  computed  using: 

B 


B  B 

=  E  A,,  (P.,,,,  )  =   E  A^  (2.72) 

b=l        "     b=l   ^ 


which  is   the  sum  of  the   vulnerable  area  of   the  individual 
cells . 

The  vulnerable  area  for  internally  detonating  HE 
warheads  is  usually  much  larger  than  the  vulnerable  area  for 
nonexplcsive  projectiles  and  fragments,  but  it  can  never 
exceed  the  aircraft's  presented  area. 

I..  7DLN1BAEILITY  TO  lASERS 

Because  a  laser  beam  must  hit  an  aircraft  to  damage  it, 
and  because  no  high  explosive  charge  is  involved,  the  meth- 
cdolcgy  for  assessing  the  vulnerability  of  aircraft  to 
lasers  consists  of  essentially  the  same  procedure  as  used  in 
the  assessment  of  aircraft  vulnerability  to  the  single 
nonexplosive  penetratcr. 

laser  vulnerability  is  particularly  threat  sensitive. 
The  first  step  of  the  assessment  consists  of  developing  a 
description  of  the  target.  Fcreign  intelligence  data  and 
mirror  technology  are  used  to  describe  the  target.  From 
this  data  a  computerized  targ€t  description  is  generated, 
allowing  the  critical  components  and  their  failure  modes  to 
be  identified.  The  second  step  of  a  laser  vulnerability 
study  is  to  accumulate  data  on  the  energy  density  required 
to  produce  failure  of  the  critical  components,  and  energy 
density  data  on  the  barrier  materials  which  shield  the  crit- 
ical components.  From  this  data,  burn  through  times  are 
calculated  as  a  function  of  laser  beam  intensity,  power, 
type  of  material,  and  thickness  using  a  parametric  penetra- 
tion equation.  A  shotline  program,  using  the  computerized 
target   description,   is   used   to   determine   the   critical 
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components  and  thid^ness  of  the  shielding  material  which 
Eust  te  penetrated  along  each  shotline.  For  each  laser 
dwell  time  interval,  energy  is  allowed  to  accumulate,  and 
the  time  it  takes  for  critical  component  failure  is 
recorded.  An  aiming  accuracy  function  is  applied  for  each 
shotline  and  the  prohability  of  kill,  given  a  laser  locked 
onto  target,  P  .   (tx  /  for  each  dwell  time  is  calculated. 

The  general  description  of  laser  vulnerability  assess- 
ment described  above  applies  orly  to  aircraft  and  ends  with 
P„,_  (t)  .    Laser   vulnerability  assessment  of  a   missile  is 

K/ Lo 

iTore  complicated  and  takes  intc  account  damage  produced  by 
the  laser  to  the  missile's  seeker/guidance  system  during  its 
trajectory  so  that  the  missile  misses  its  target.  It  should 
be  noted  that,  for  an  air  deferse  weapon,  the  laser  is  not 
effective  in  bad  weather  conditions  where  the  relative 
humidity  is  high. 

G.   CCMPUTER  PROGRAMS  FOR  VULNEf ABILITY  ASSESSMEST 

The  determination  of  an  aircraft's  vulnerability  can  be 
a  complex  and  time  consuming  task.  When  done  manually,  many 
simplifications  and  assumptions  are  made,  the  results  are 
subject  to  interpretation,  and  the  output  is  usually  limited 
in  sccfe.  Conseguently,  an  extensive  number  of  computer 
programs  or  models  have  been  developed  by  the  U.S.  military 
and  industry  for  assessing  aircraft  vulnerability.  These 
programs  can  be  divided  into  four  major  categories;  shot- 
line  generators,  vulnerable  area  routines,  internal  burst 
programs,  and  Endgame  programs.  Programs  in  the  first  two 
categories  are  used  for  the  peretrator  and  single  fragment 
damage  mechanisms.  Those  in  the  third  category  are  used  for 
internally  detonating  HE  warheads,  and  those  in  the  fourth 
category  are  for  the  proximity  fuzed  HE  warhead.  (The 
reader  is   cautioned  that  just   because  a  computer   is  used. 
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the  results  are  not  to  be  treated  as  sacrosanct.  The  output 
is  no  mere  valid  than  the  assumptions  that  were  used  to 
develop  the  model  and  the  input  data.) 

Computerized  techniques  for  vulnerability  estimates  for 
nonexplcsive  projectiles  and  single  fragments  are  currently 
in  wide  use.  A  prerequisite  fcr  performing  such  analyses  is 
the  generation  of  a  geometric  model  of  the  aircraft 
describing  all  of  the  critical  components  and  the  lajor 
structure  and  nonvulnerable  components  that  provide 
shielding  for  the  critical  components.  The  computer  is  then 
prograirnied  to  project  shotlines  (parallel  rays)  through  this 
model,  from  selected  viewing  asjects  to  provide  a  sequential 
listicg  of  penetration  data  for  input  to  a  computerized 
vulnerability  analysis. 

''  •   iliO^iiSl^  Generators 

These  prograns  generate  shotline  descriptions  of 
aircraft  targets  for  use  as  input  data  to  the  codes  which 
calculate  vulnerable  area.  The  programs  usually  model  the 
aircraft  external  surface  and  the  individual  internal  and 
external  components  either  with  a  set  of  geometric  shapes  or 
with  surface  patches.  The  target  geometric  information 
required  to  assess  the  vulnerability  by  computer  program  is 
generated  mathematically  by  superimposing  a  planar  grid  over 
the  target  model  and  by  passing  a  large  number  of  parallel 
rays  through  the  target  from  the  attack  direction  to  the 
ether  side  (normal  to  the  grid)  through  individual  grid 
cells,  as  shown  in  Figure  2.34.  The  position  and  number  of 
rays  is  determined  by  means  of  the  superimposed  grid.  The 
number  of  rays  is  controlled  bj  selecting  the  size  of  the 
individual  squares  of  the  grid.  One  shotline  is  randomly 
located  within  each  cell.  Each  ray-surface  encounter  is 
listed  sequentially  aid  identifies  the  ray  location,  surface 
identification  number,   thickness,  obliquity  angle,  airspace 
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encouEtered,   and  distance  between  internal  surfaces.    This 

procedure  is  repeated  for  all  shotlines  originating  frcni  the 

selected   attack  directions.     Also   the   A   of   designated 

P 
components   and  of   the  overall   target  is   output  for   each 

viewing  aspect.  The  A^  is  approximated  by  multiplying  the 
number  of  rays  intersecting  the  target  by  the  area  of  the 
individual  cells  making  up  the  grid  plane. 

Two  families  of  shotline  generator  routines  have 
teen  developed.  Thej  are  the  MAGIC,  GIFT  family  and  the 
SHOTGEN,  FASTGEN  fanily.  The  MAGIC  and  GIFT  codes  were 
developed  at  the  U.S.  Army  Ballistic  Research  Laboratory, 
Aberdeen  Proving  Ground,  MD .  These  codes  use  the  combinato- 
rial geometry  approach,  with  basic  body  shapes  such  as 
spheres,  boxes,  cylinders,  ellipsoids,  and  cutting  or 
bounding  planes,  to  describe  components.  GIFT  is  an 
improved  version  of  MAGIC,  with  simpler  input  requirements, 
more  efficient  computation,  acd  computer-generated  graphic 
displays.  The  second  family,  SHOTGEN  and  the  more  recent 
FASTGEN  and  FASTGEH  II,  is  somewhat  similar  to  the  ether 
family,  but  typically  uses  the  flat  triangular  patch  method 
to  describe  the  component  surfaces.  SHOTGEN  was  developed 
by  the  Naval  Weapons  Center,  ard  FASTGEN  and  FASTGEN  II  are 
improved  versions  of  SHOTGEN  sponsored  by  the  Air  Force 
Aeronautical  Systems  Division  (iiSD)  .  Figure  2.35  shows  the 
external  view  of  a  model  built  using  the  combinatorial  geom- 
etry approach,  and  Figures  2.36  and  2.37  show  the  external 
view  and  some  interral  compcrents  of  a  flat  triangular 
surface  patch  model,  respectively. 

2-   jiilnerable  Area  Routines 

These  programs  generate  component  and  total  aircraft 
vulnerable  area  tables  for  a  single  penetrator  or  fragment. 
The  vulnerable  area  routines  car  be  divided  into  two  groups, 
the  "detailed"  or  analysis  routines,   which  use  the  shotline 
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approach  to  compute  the  vulnerable  area,  and  the  "sicpli- 
fied"  or  evaluation  routines  which  use  simplified  approaches 
to  determine  the  vulrerable  area.  The  routines  in  the  anal- 
ysis group  are  usually  used  for  problems  requiring  in-depth 
studies.  However,  they  have  the  potential  for  use  in  early 
design  studies  in  which  only  a  limited  amount  of  technical 
descriptive  data  is  available.  The  evaluation  routines  are 
more  appropriate  for  problems  in  which  a  cursory  analysis  is 
desired. 

a.   Analysis  routines 

The  programs  VAREA,  VAREA02,  and  COVARl  belong 
to  the  detailed  group.  Inputs  to  these  programs  include  the 
shotline  descriptions  of  the  target  model  generated  by  the 
shotline  programs,  probability  of  kill  given  a  hit  data  for 
the  individual  components,  empirical  ballistic  penetration 
data,  and  weapon  characteristics  data.  Component  and 
aircraft  single  hit  vulnerable  area  data  are  output  in 
tabular  form. 

VAEEA  is  the  oldest  and  least  comprehensive  cf 
the  three  routines  in  this  group.  It  was  developed  in  1965 
by  the  Naval  Weapons  Center  to  conduct  vulnerability  anal- 
yses cf  systems  subjected  to  fragmenting-type  threats  and 
uses  the  THOR  penetration  equations  to  compute  penetrator 
mass  and  velocity  decay  due  to  penetration  through  the 
components  along  the  shotline.  VAREA02,  completed  in  1973, 
evolved  from  the  VAEEA  program.  Its  added  capabilities 
include  a  projectile  penetration  mode,  an  air  gap  fire 
model,  a  redundant  components  nodel,  and  an  option  to  use 
the  DEI  penetration  equations  irstead  of  the  THOR  relations. 

COVART  (Computaticr  of  Vulnerable  Area  and 
Repair  Time)  currently  represents  the  state-of-the-art  in 
vulnerable  area  routines.  It  incorporates  all  cf  the 
features   of    the   VAEEA02    program   and    the   helicopter 
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vulnerahle  area  routines  from  tte  HART  program  and  includes 
a  battle  damage  repair  time  model.  The  procedure  used  by 
COVAET  tc  compute  single  hit  vulnerable  areas  is  essentially 
the  same  as  that  described  in  this  chapter  for  the  single 
nonexplosive  penetratcr  or  fragnent.  The  component  vulner- 
able area  of  each  cell  is  the  product  of  the  cell  presented 
area  and  the  probability  of  conponent  kill  for  the  shctline 
in  that  cell.  The  vulnerable  area  of  each  component  is  the 
sum  of  the  component  vulnerable  areas  computed  for  each  grid 
cell  whose  shotline  passes  through  the  component.  The  total 
aircraft  vulnerable  area  is  the  sum  of  all  of  the  cell  vuln- 
erable areas,  considering  onl^  the  nonredundant  critical 
components  and  any  redundant  critical  component  overlap. 
Both  true  and  incremental  vulnerable  areas  are  available  for 
the  overlapping  components,  redundant  critical  components 
that  do  not  lie  along  the  same  shotline  do  not  contribute  to 
the  aircraft  vulnerability, 

b.   Evaluation  Routines 

The  computer  progran  COMVAT  is  representative  of 
the  routines  which  belong  to  the  other  group,  the  sin:plified 
codes.  These  routines  were  developed  to  fulfill  the  need 
for  relatively  quick  methods  fcr  computing  vulnerable  area. 
They  are  intended  tc  be  used  in  situations  when  use  of  the 
more  sophisticated  routines  maj  not  be  feasible  or  timely, 
such  as  during  early  conceptual  design  studies.  The  sicpli- 
fied  routines  are  not  as  accurate  as  the  detailed  routines, 
but  they  should  reguire  ccrsiderably  less  effort  and 
computer  run  time  to  use, 

COMVAT  was  developed  specifically  to  compute  the 
vulnerable  areas  of  aircraft  components  to  projectile 
threats.  It  is  based  upon  the  same  principles  as  the 
detailed  routines,  but  it  does  not  use  shotline  descriptions 
of  the  aircraft;   instead,   it  computes  component  vulnerable 
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areas  on  the  basis  of  input  data  describing  average 
shieldirg  conditions  en  the  coiponents.  The  THOE  penetra- 
tion equations  are  used  to  model  projectile  velocity  decay. 
Secondary  effects  such  as  spalling,  projectile  yawing 
motions,  and  projectile  break-uf  are  ignored. 

3-   Internal  Burst  Programs 

Several  programs  for  coirputing  the  vulnerability  of 
aircraft  to  internally  detonating  HE  warheads  have  been 
developed  under  the  directicr  of  the  Joint  Technical 
Coordinating  Group  for  Munitions  Effectiveness  (JTCG/ME) . 
These  programs  are  sometimes  referred  to  as  point  burst 
programs,  and  the  test  known  program  is  the  PCIHTEOFST 
program.  This  program  uses  the  second  approach  described  in 
the  section  on  vulnerability  to  internally  detonating  HE 
warheads  which  is  the  point  burst  approach. 

'^  •   Endgame  Pr o^ rams 

The  Endgame  refers  to  the  terminal  events  in  an 
encounter  between  an  aircraft  and  an  HE  warhead  with  a  prox- 
imity fuze.  Just  how  the  warhead  got  to  the  vicinity  of  the 
aircraft  is  irrelevant  to  the  Zrdgame  analysis.  The  Erdgame 
events  may  include  target  detection  by  the  fuze,  and  usually 
do  include  the  warhead  detonation,  blast  propagation,  and 
fragment  flyout,  iipact,  and  penetration  through  the 
aircraft.  The  numerical  value  for  the  P  is  then  deter- 
mined for  the  given  set  of  enccunter  conditions  and  warhead 
and  aircraft  characteristics.  This  procedure  is  usually 
repeated  for  many  different  sets  of  encounter  conditions  and 
warhead  detonation  points,  and  P^/d  -^^  established  as  a 
function  of  the  detonation  distance.  Four  Endgame  programs 
currently  in  use  are  SESTEM  II,  SCAN,  ATTACK,  and  BEFMCD  or 
MECA.   A  fifth  program,  SHAZAM,  is  nearing  completion. 
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a.   SESTZM  II 

This  program  was  developed  in  1977  by  the  U.S. 
Air  Porce  Aeronautical  Systems  Division  to  evaluate  the 
terminal  effectiveness  of  missiles  with  nonnuclear  blast  and 
fragmentation  warheads  against  aerial  targets.  The  P  is 
computed  with  respect  to  a  direct  hit,  fragment  damage,  and 
blast.  The  program  has  the  capability  to  simulate  several 
fuzing  options  and  a  general  terminal  encounter  geometry. 
The  fragment  spray  angles  and  density,  and  fragment  average 
mass,  static  velocity,  cross-sectional  area,  and  coefficient 
of  drag  are  input  data.  The  target  is  represented  as  a 
collection  of  shapes  that  are  either  single  fragment  vulner- 
able, masking,  or  fuzing  comjcnents.  The  external  shapes 
(wing,  fuselage,  etc.)  are  nodeled  using  ellipses,  and 
rectangular  parallelpipeds  are  used  for  the  internal  compo- 
nents, such  as  fuel  tanks  ano  electronics.  The  vulner- 
ability of  the  components  is  represented  by  vulnerable  area 
tables.  The  prograir  can  be  used  to  generate  iso-?j^,j-, 
contours. 

t.   SCAN 

SCAN  was  developed  in  1976  under  the  supervision 
cf  the  D.S.  Navy  Pacific  Missile  Test  Center  (PMTC)  for  the 
Joint  Technical  Coordinatirg  Group  for  Aircraft 
Survivability  (JTCG/AS) .  The  objective  of  SCAN  is  to 
predict  the  probability  that  an  aircraft  will  survive  an 
attack  by  a  missile  armed  with  a  warhead.  Aircraft  kills 
due  tc  direct  hit,  fragment  damage,  and  blast  are  evaluated. 
A  few  fuzing  options  are  considered,  as  well  as  a  general 
terminal  encounter  geometry.  The  warhead  is  divided  into 
polar  and  radial  zones  and  different  fragment  sizes,  shapes, 
and  materials  can  be  specified  within  each  zone.  The  target 
is  modeled  using  the  combinatorial  geometry  approach,  and 
component  vulnerability  to  single  fragments  is  expressed  by: 
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P  =   C      +   [C      X    Wass  ]   +    [C      X    Velocity]  (2.73) 

k/h      1     ^  2  3 

vhere  mass  and  velocity  refer  to  the  fragment  mass  and 
velocity.  The  energy  density  ard  area  removal  kill  criteria 
are  also  options  for  use  with  components  such  as  major 
structures.  Each  ccnponent  is  given  a  material  and  thick- 
ness and  is  linked  to  a  subsystem,  system,  or  aircraft  kill 
ty  a  logical  kill  expression,  thus  allowing  the  considera- 
tion of  redundancy.  SCAN  also  has  graphics  capabilities  for 
evaluation  of  the  input  geometric  model  and  output  fragment 
impact  data. 

C.   ATTACK 

ATTACK  is  a  Naval  Weapons  Center  revision  of  an 
Endgame  methodology  developed  at  the  Naval  Missile  Center, 
Point  Mugu.  The  object  of  ATTSCK  is  to  predict  the  ability 
of  a  missile  to  detect  and  destroy  an  airborne  target. 
Direct  hit,  blast,  and  single  fragment  (component) ,  and 
multiple  fragment  (structural)  kills  are  considered,  and  a 
general  terminal  encounter  geometry  is  provided.  The 
warhead  in  ATTACK  uses  the  concept  of  polar  and  radial  frag- 
ment spray  zones  and  fragment  weight  classes.  A  large 
number  of  fuze  options  are  available.  The  program  reguires 
four  target  models,  one  for  each  type  of  damage,  and  one 
fuze  model  for  each  ercounter.  The  components  in  the  single 
fragmert  model  are  physically  represented  by  spheres  at 
specified  locations,  and  the  vulnerability  of  each  component 
is  ccEtained  in  vulnerable  area  tables  that  depend  upon 
aspect  angle,  fragment  mass,  and  fragment  impact  velocity. 
The  nultiple  fragment  model  uses  a  segmented  cylindrical 
target  representation,  and  the  vulnerability  of  each  segment 
is  specified  by  a  critical  level  of  fragment  energy  density. 
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a.   REFMOD  (WECA) 

The  REFJ1CD  prograir,  developed  in  1981,  was 
intended  tc  be  a  reference  model  to  be  used  for  cciDputing 
the  effectiveness  of  externallj  detonating  weapons  against 
moving  targets.  (It  was  later  renamed  Modular  Endgame 
Computer  Analysis  or  MECA) .  The  model  was  developed  under 
the  ausfices  of  the  JTCG/ME  Anti-Air  Missile  Evaluation 
Group.  lEFMOD  has  been  assecbled  by  incorporating  methcdcl- 
ogies  frcm  many  other  existing  Endgame  programs,  including 
some  significant  additional  features  that  enable  it  tc  work 
with  a  wide  variety  cf  vulneratility  models  and  to  evaluate 
■warhead-target  combinations  that  were  previously  tco  cumber- 
some to  assess.  The  warhead  types  considered  include  the 
continuous  rod,  divergent  fragaent  spray,  convergent  frag- 
ment spray,  focused  fragment  controlled  motion,  and  an 
aimable  warhead  in  which  the  fragment  spray  density  is  non- 
uniform about  the  missile  axis.  Several  fuze  routines  are 
available,  and  the  option  exists  for  the  specification  cf 
fuzing  data  from  flight  tests.  The  target  model  and  vulner- 
ability employed  depend  upon  the  damage  mechanism  selected. 
These  include  direct  hit,  blast,  fragment,  and  continuous 
rod.  Component  vulnerability  types  for  fragments  include 
both  vulnerable  area  and  a  Py.,^  kill  criterion  that  is  a 
function  of  mass,  velocity,  and  density.  For  the  vulnerable 
area  model,  components  can  te  described  as  spherical, 
linear,  cylindrical,  cr  planar  in  shape,  and  the  ccmpcnent 
vulnerable  area  tables  generated  by  COVART  can  be  used.  The 
^k/h  vulnerability  model  employs  cylindrical  components,  and 
the  ccnpcnent  kill  criterion  is  given  by: 


^2  „  ,„_.   ...  ,  ^3 


:/h 


=  C^  X  (Mass)    X  (Velocity)  (2.74) 
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with  lover  and  upper  threshold  values.  By  inputting 
different  values  for  Ci  ,  C  ,  and  C^  ,  a  variety  of  kill 
criteria  can  be  employed.  For  example,  when  C-^  =  0.5,  C2  = 
^,    and  0^=2,  the  erergy  density  criterion  is  specified. 

€.   SHAZAH 

This  code  was  de^ieloped  at  the  Air  Force 
Armament  laboratory  (AFATl/DLY)  for  the  evaluation  of  air- 
to-air  Eissile  effectiveness.  The  program  sequentially 
assesses  the  possibility  the  target  aircraft  is  directly 
impacted  by  the  missile,  the  effect  of  blast  overpressures 
upon  the  target  structures,  and  the  cumulative  effect  of 
warhead  fragment  impacts  on  the  target  structure  and  crit- 
ical components.  The  size,  shape,  and  position  cf  the 
target  tody  and  internal  components  are  described  by 
discrete  surfaces,  ard  each  surface  can  be  vulnerable  to  a 
direct  hit,  to  blast,  or  to  fragments.  The  criteria  used  to 
define  the  kill  of  each  comporent/surf ace  are  supplied  by 
the  user.  The  program  utili2es  as  much  of  the  aircraft 
descriptions  that  are  prepared  for  the  SHOTGEN  and  "VAEEA 
programs  as  is  economically  feasible.  A  sufficiently  large 
number  of  encounter  conditions  are  assessed  to  generate  a 
single  shot  probability  of  kill  that  has  converged  to  a  user 
specified  confidence  level. 
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